feat(analytics): add MCP package and API compatibility adoption tracking

[JSONbored]

Background

MCP adoption depends on clients staying compatible. We need to know which package versions are in use and help users upgrade when stale.

Goal

Track MCP versions in use and whether clients are stale or incompatible with the live API.

Current Behavior

Doctor/status can detect some local setup issues, but adoption and compatibility are not aggregated into product analytics.

Desired Behavior

MCP clients report safe version metadata and the control panel/API can show stale or incompatible client distribution.

Implementation Requirements

• Emit redacted client version/product events from CLI/MCP requests.
• Expose API compatibility metadata.
• Improve doctor/status upgrade hints where needed.
• Mock npm registry lookups in tests.
• Do not log auth tokens or local absolute paths.

Public/Private Output Boundaries

Public GitHub output must never include wallets, hotkeys, payout/reward estimates, raw trust scores, public score estimates, private reviewability, private scoreability context, or farming language. Private API/MCP/control-panel surfaces may show authenticated scoreability, blockers, projections, and evidence, but must not claim guaranteed payout outcomes.

Acceptance Criteria

• doctor/status can report stale installs.
• Control panel can show MCP version distribution.
• API exposes compatibility metadata.
• Tests mock npm registry and API version responses.

Testing Requirements

• npm run test:ci must pass.
• Global coverage must remain at or above 97% for lines, statements, functions, and branches.
• Aim for 98%+ branch coverage locally.
• Add tests for every new branch, fallback path, sanitizer rule, and regression.
• Add invariant/property-style tests when behavior depends on sorting, gating, scoring, source-upload safety, public/private boundaries, or telemetry privacy.
• MCP/local tooling must prove source contents are not uploaded when local metadata is involved.
• Public GitHub output must be tested against forbidden language: wallet, hotkey, raw trust score, payout, reward estimate, farming, private reviewability, and public score estimate.