feat: add global preferences and privacy-preserving telemetry

[Icemap]

Summary

• Move global logging preferences to the optional hidden ~/.tdc/.preferences file, with safe migration from the legacy [logging] section in ~/.tdc/config.
• Add best-effort, privacy-preserving command completion telemetry for release builds, including strict command eligibility, a pseudonymous installation ID, explicit field allowlisting, and persistent or process-scoped opt-out controls.
• Configure the production ingestion endpoint at https://tdc-telemetry.tidbcloud.com, show the telemetry notice only from release installers, and allow the deployment workflow to update the server-side public hostname without exposing backend credentials.
• Add v0.1.6 release notes and move the completed telemetry specification into docs/spec/done/.

User impact

Release builds send at most one anonymous completion event for eligible commands. Events contain command and flag names without values, stable result codes, duration, placement, and runtime metadata. Credentials, tokens, SQL, paths, contents, output, raw errors, profile names, and cloud resource IDs are excluded. Help, version, commandless usage, all tdc update modes, development builds, and recognized CI environments do not send telemetry by default.

Users can opt out persistently with [telemetry] enabled = false in ~/.tdc/.preferences, or for one process with TDC_TELEMETRY=off.

Validation

• make test
• make e2e
• Release-style linker injection check for the production telemetry endpoint
• Production backend checks: /healthz 200, /readyz 200, and ingestion 202 at tdc-telemetry.tidbcloud.com
• Successful telemetry deployment workflow run: https://github.com/tidbcloud/tdc/actions/runs/30380337458