Remove telemetry, data exfiltration, and harden security

Phase 1 - Remove PostHog telemetry:
- Gut forge_tracker crate, replace with no-op stubs preserving API surface
- Remove PostHog HTTP collector, machine fingerprinting, email harvesting
- Remove posthog-rs and machineid-rs dependencies
- Remove POSTHOG_API_SECRET from CI workflows and forge_ci
- Keep local file-based logging (daily rolling), remove PostHogWriter

Phase 2 - Remove source code upload:
- No-op all gRPC methods in ForgeContextEngineRepository
- No-op ForgeGrpcClient (dummy channel, no connections)
- Clear default services_url in .forge.toml
- Handle empty services_url gracefully in ForgeInfra init

Phase 3 - Remove auto-update:
- Replace on_update() with no-op stub
- Remove update-informer dependency
- Remove auto-update config from .forge.toml
- Call sites in ui.rs unchanged (they call the no-op)

Phase 4 - Security hardening:
- Restrict default permissions to home dir + /tmp (was allow all)
- Redact Debug impl on all secret types (ApiKey, tokens, etc.)
- Add x-api-key to header sanitization
- Set chmod 600 on credential files after writing
- Filter env vars for MCP clients to safe whitelist

Author: maroun2

.github/workflows/ci.yml

@@ -195,7 +195,6 @@ jobs:
         cross-version: '0.2.5'
       env:
         RUSTFLAGS: ${{ env.RUSTFLAGS }}
-        POSTHOG_API_SECRET: ${{secrets.POSTHOG_API_SECRET}}
         APP_VERSION: ${{ needs.draft_release.outputs.crate_release_name }}
     - name: Copy Binary
       run: cp ${{ matrix.binary_path }} ${{ matrix.binary_name }}
@@ -290,7 +289,6 @@ jobs:
         cross-version: '0.2.5'
       env:
         RUSTFLAGS: ${{ env.RUSTFLAGS }}
-        POSTHOG_API_SECRET: ${{secrets.POSTHOG_API_SECRET}}
         APP_VERSION: ${{ needs.draft_release_pr.outputs.crate_release_name }}
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/release.yml

@@ -106,7 +106,6 @@ jobs:
         cross-version: '0.2.5'
       env:
         RUSTFLAGS: ${{ env.RUSTFLAGS }}
-        POSTHOG_API_SECRET: ${{secrets.POSTHOG_API_SECRET}}
         APP_VERSION: ${{ github.event.release.tag_name }}
     - name: Copy Binary
       run: cp ${{ matrix.binary_path }} ${{ matrix.binary_name }}