Analytics, self-update and Report a problem

- Anonymous PostHog analytics (ui/frame_telemetry.py): usage on by default
  after a first-run notice; compatibility results and error details opt-in,
  offered together by the notice's "Share more to help fix problems" button.
  Random id, no person profiles or GeoIP, scrubbed text, an offline outbox,
  and "Show what's been sent" in the new Privacy panel. Inert without a
  project key, from a source checkout, or with DO_NOT_TRACK=1.
- APK installs now record install_failed when the APK itself won't install,
  and offer a 20-second test after installing. Opted-in reports reach the
  shared database through PostHog and `frame_compat_db.py sync`.
- The desktop app updates itself from published releases (app/updater.js):
  update.json from releases/latest/download, SHA-256 checked, no downgrades;
  macOS bundle swap, Windows NSIS, Linux AppImage, otherwise the release page.
  scripts/publish-release.sh publishes a tested draft with its manifest.
- Report a problem (header button, Privacy panel, Help menu) files a GitHub
  issue through the website's feedback API, with a previewed, scrubbed
  diagnostics snapshot; activity and logs only when asked for.

Reviewed by GPT-6 Astra (xhigh, read-only) three times; all findings fixed.
Docs: docs/privacy.md, docs/releasing.md.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

scripts/publish-release.sh

@@ -0,0 +1,45 @@
+#!/bin/sh
+# Publish a tested draft release so running copies of Frame Control offer it
+# (docs/releasing.md). Checks every installer is attached with a SHA-256
+# digest first, since the app's updater refuses assets without one, then
+# attaches update.json, the manifest the updater reads.
+# Usage: scripts/publish-release.sh v0.4.0
+set -eu
+tag="${1:?usage: $0 vX.Y.Z}"
+repo=saphid/frame-control
+expected="Frame-Control-mac-arm64.dmg Frame-Control-mac-arm64.zip Frame-Control-Setup-x64.exe
+Frame-Control-win-x64.zip Frame-Control-linux-x86_64.AppImage Frame-Control-linux-arm64.AppImage
+Frame-Control-linux-amd64.deb Frame-Control-linux-arm64.deb"
+
+info=$(gh release view "$tag" -R "$repo" --json isDraft,isPrerelease,assets)
+version=$(sed -n 's/.*"version": *"\([^"]*\)".*/\1/p' "$(dirname "$0")/../app/package.json")
+[ "v$version" = "$tag" ] || echo "note: app/package.json here says $version (the release was built from the tag)"
+
+missing=""
+for name in $expected; do
+  digest=$(printf '%s' "$info" | python3 -c 'import json,sys
+d=json.load(sys.stdin); n=sys.argv[1]
+print(next((a.get("digest") or "" for a in d["assets"] if a["name"]==n), "absent"))' "$name")
+  case "$digest" in
+    sha256:*) echo "ok       $name" ;;
+    absent) echo "MISSING  $name"; missing=1 ;;
+    *) echo "NO HASH  $name"; missing=1 ;;
+  esac
+done
+[ -z "$missing" ] || { echo "not publishing: fix the assets above" >&2; exit 1; }
+
+# update.json: what running copies read (app/updater.js), from github.com's
+# latest/download link rather than the rate-limited REST API.
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+gh release view "$tag" -R "$repo" --json tagName,url,body,assets | python3 -c 'import json,sys
+d=json.load(sys.stdin)
+names=set(sys.argv[1].split())
+print(json.dumps({"version": d["tagName"].lstrip("v"), "page": d["url"], "notes": d["body"][:4000],
+                  "assets": [{"name": a["name"], "size": a["size"], "digest": a["digest"]}
+                             for a in d["assets"] if a["name"] in names]}, indent=1))' "$expected" > "$tmp/update.json"
+gh release upload "$tag" -R "$repo" "$tmp/update.json" --clobber
+echo "ok       update.json"
+
+gh release edit "$tag" -R "$repo" --draft=false --prerelease=false --latest
+echo "published $tag; running copies will offer it at their next check"