feat(build): add defaults-without-telemetry feature alias

[russellb]

Summary

Adds a defaults-without-telemetry Cargo feature alias to the three binary crates that carry telemetry, so compiling telemetry out no longer means hand-maintaining a keep-list of each crate's other default features. Telemetry-free builds become --no-default-features --features defaults-without-telemetry.

Related Issue

No accepted issue yet — raising this for maintainer disposition. It came out of a contributor question about whether --no-default-features is a safe stand-in for "disable telemetry." It is not, and that is already a live correctness bug (see Changes), so this is filed as a PR rather than a spike. Happy to open a feature request issue first if the convention should apply here.

Changes

Cargo cannot subtract a single default feature, so the documented way to compile telemetry out is --no-default-features plus every other default re-added by hand. That keep-list is already wrong for operators:

Crate	default	Bare --no-default-features also drops
openshell-server	["telemetry"]	—
openshell-driver-vm	["telemetry"]	—
openshell-sandbox	["telemetry", "bundled-ca-roots"]	bundled-ca-roots

Following the README today therefore silently swaps the supervisor from bundled Mozilla roots onto the platform trust store. The alias fixes that and stays correct as the default set grows.

• Add defaults-without-telemetry to openshell-server, openshell-sandbox, and openshell-driver-vm, each enumerating its defaults minus telemetry.
• Add a compile_error! in each crate root for telemetry + defaults-without-telemetry. The alias is a keep-list, not a switch — without the guard, --features defaults-without-telemetry on its own (no --no-default-features) would compile a telemetry-on binary that reads as telemetry-free.
• Add rust:verify:defaults-without-telemetry (tasks/scripts/verify-defaults-without-telemetry.sh), which asserts via cargo metadata that each alias still equals its crate's defaults minus telemetry, and that the mutual-exclusion error is wired up. The second check matches on the compile_error! text rather than a nonzero exit code, so it cannot pass vacuously on hosts where openshell-driver-vm fails to build for unrelated reasons.
• Point rust:verify:telemetry-off at the alias, so CI builds the artifacts the same way the docs tell operators to.
• Run the new task in branch-checks.yml.
• Update the telemetry section of README.md and the Build Features section of architecture/build.md.

openshell-core also defaults to telemetry, but is left alone: every consumer already depends on it with default-features = false, so an alias there would be a no-op.

Testing

Command	Result
mise run pre-commit	pass
mise run test	pass, 0 failures
mise run rust:verify:telemetry-off	pass — positive control present in the default gateway, markers absent from both telemetry-free binaries
mise run rust:verify:defaults-without-telemetry	pass, 6/6 checks
mise run rust:verify:system-ca-roots	pass

Negative-controlled the drift check by temporarily setting the sandbox alias to []; it failed with the expected diff and exit 1, then passed again on restore.

Not run: mise run e2e. This changes build-time feature wiring, not sandbox runtime behavior, and the telemetry-off guard already inspects the resulting binaries.

• mise run pre-commit passes
• Unit tests added/updated — covered by the two rust:verify:* guards rather than #[test]s; feature-set drift and compile_error! wiring are not observable from inside a compiled test binary
• E2E tests added/updated (if applicable) — not applicable

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.