Fail-safe, private telemetry and best-effort maintenance

Telemetry, diagnostics, warning hooks, tee branches, and best-effort maintenance must never throw, block, delay, replace terminal delivery, stop schedulers, or otherwise alter behavior. Disabled backends are no-ops. Validate inputs and categories against canonical allowlists; contain failures from hooks, capture, formatting, logging, workers, and cleanup, and test that throwing diagnostics leave responses unchanged. Keep work bounded, idempotent, and preferably post-response. Emit only reviewed fixed-message events, sanitized aggregates, and bounded allowlisted metadata; never include raw queries, content, identities, fingerprints, provider text, exception payloads, private results, or inherited trace/request context. Clear request-local state at finalization.