Wire AMS's dead orb-export.js telemetry stub to a real central ingest endpoint

[JSONbored]

Problem

packages/gittensory-miner/lib/orb-export.js already builds a correctly-shaped, HMAC-anonymized batch of PR-outcome telemetry mirroring Orb's own self-host collector — but per its own comments (lines 16-17, 161-163) it deliberately never performs the network send. AMS today has zero visibility into miner-side growth/usage/outcome metrics beyond what an operator can see on their own single machine, unlike Orb's orb_signals/orb_pr_outcomes central tables, which already give gittensory/LoopOver real adoption and outcome data for Orb.

Area

gittensory-miner + central ingest (src/orb)

Proposal

Finish wiring orb-export.js's existing batch-building logic to a real network send, mirroring Orb's self-host collector's cadence and endpoint pattern (ORB_COLLECTOR_URL, default https://api.loopover.ai/v1/orb/ingest). Decide and implement the central-side ingest surface during build: either a new ams_signals/ams_instances table pair mirroring orb_signals/orb_instances, or a shared product discriminator column added to the existing tables so one ingest pipeline and one analytics.ts-style aggregation serves both products without duplicating the D1 schema — prefer the discriminator-column approach unless a concrete field mismatch forces separate tables. Reuse the shared anonymization primitive from the companion extraction issue rather than reimplementing HMAC logic a second time.

Deliverables

• orb-export.js wired to a real fetch POST against the ingest endpoint, using the shared anonymization primitive
• A contiguous migrations/NNNN_*.sql for whichever schema decision is made
• Central ingest route (mirroring src/orb/ingest.ts's validation/insert pattern) accepting AMS's batch shape
• docs/observability.md updated to describe the new central export path alongside the existing local-only Prometheus/Grafana docs
• Full unit test coverage for the new send path: success, network failure fails open (matches the existing local-only paths' failure posture), opt-out respected

Resources

• packages/gittensory-miner/lib/orb-export.js (existing dead stub to finish)
• src/selfhost/orb-collector.ts + src/orb/ingest.ts (Orb's live send/ingest pattern to mirror)
• The companion shared-anonymization-primitive issue (sequence this after it merges)

Boundaries

• Must NOT modify Orb's own existing telemetry rows/semantics — this only adds AMS's send side and (if needed) a discriminator column or parallel tables, never touches existing orb_signals/orb_pr_outcomes data.
• The cross-tenant-leakage audit for a future hosted AMS is tracked separately in Audit: privacy pass on AMS telemetry/export surfaces for cross-tenant leakage #5219 — this issue is scoped to today's self-hosted, single-operator AMS phoning telemetry home to a central collector, the same trust model Orb's self-host already operates under, not a multi-tenant hosted redesign.
• Default-on (matching Orb's opt-out-by-default) vs. default-off is a real product/privacy decision affecting every existing self-hosted AMS install, not an implementation detail — ship this defaulted OFF (opt-in) unless a maintainer explicitly signs off on defaulting it on before merge.

[linear-code]

JSO-3891

[JSONbored]

Depends on #5680 landing first (shared anonymization primitive). Related but independent: #5682 (OAuth onboarding).

[JSONbored]

Scope correction after reading orb-export.js closely: it already has its own local hmacAnonymize(value, secret) (lines 49-52) and inline randomBytes(32).toString("hex") secret generation (line 107) — a near-identical duplicate of what #5680 just extracted, not merely "code to reuse the primitive for." Part of this issue's work is now a straight replace: swap both for the #5680 imports (hmacAnonymize, generateAnonSecret) and drop the local duplicates, on top of the real new work (wiring the actual network POST, which today never happens per the module's own header comment).