Add hook timestamp to telemetry reporting

[rishiy15]

What's Changed

Adds an optional ts field (Unix epoch milliseconds — when the hook actually fired) to both telemetry events the plugin emits. This lets the 1Password desktop app, which ingests these events asynchronously, attribute each event to the time it occurred rather than the time it happened to be drained.

Area	Change
scripts/lib/telemetry.sh	New ts_json_fragment helper that emits ,"ts":<epoch_ms>; wired into write_execution_event and write_install_event.

Why

Telemetry events are written to disk and picked up out-of-band by the 1Password app — which may be closed or locked when a hook runs, so a backlog can be drained minutes-to-days later. Without a producer-side timestamp, every drained event is dated to ingest time, which fabricates a usage spike on the drain day and leaves the real days empty. Stamping the hook-fire time at write lets the app bucket events correctly (it maps ts onto the Snowplow device-created timestamp).

Event shape

ts is appended to the existing JSON lines, e.g.:

{"schema":"agent_hook_execution","hook_name":"1password-validate-mounted-env-files","hook_version":"1.1.0","client":"cursor","event_type":"before_shell_execution","decision":"allow","deny_reason":null,"duration_bucket":"ms_0_to_50","mode":null,"mount_count":null,"ts":1782429269433}

Safety & compatibility

• Backward compatible. The field is optional — the app falls back to ingest-time when it's absent, so old and new plugin versions both work.
• Never produces malformed JSON. ts_json_fragment only emits the fragment when the clock reads back as a plain integer; otherwise it emits nothing (a missing field, not a broken line).
• No new data category. ts is a coarse event timestamp — no paths, contents, or PII. Consent gating, the 1 MB file cap, fail-open behavior, and hook decisions are all unchanged.

Testing Done

• bash -n scripts/lib/telemetry.sh — syntax clean.
• Emitted execution and install events with consent enabled and confirmed each line is valid JSON (python3 -m json.tool) with ts present as an unquoted integer.
• Verified events without the field still parse, confirming the optional/backward-compatible contract.