Analytics, self-update and Report a problem

- Anonymous PostHog analytics (ui/frame_telemetry.py): usage on by default
  after a first-run notice; compatibility results and error details opt-in,
  offered together by the notice's "Share more to help fix problems" button.
  Random id, no person profiles or GeoIP, scrubbed text, an offline outbox,
  and "Show what's been sent" in the new Privacy panel. Inert without a
  project key, from a source checkout, or with DO_NOT_TRACK=1.
- APK installs now record install_failed when the APK itself won't install,
  and offer a 20-second test after installing. Opted-in reports reach the
  shared database through PostHog and `frame_compat_db.py sync`.
- The desktop app updates itself from published releases (app/updater.js):
  update.json from releases/latest/download, SHA-256 checked, no downgrades;
  macOS bundle swap, Windows NSIS, Linux AppImage, otherwise the release page.
  scripts/publish-release.sh publishes a tested draft with its manifest.
- Report a problem (header button, Privacy panel, Help menu) files a GitHub
  issue through the website's feedback API, with a previewed, scrubbed
  diagnostics snapshot; activity and logs only when asked for.

Reviewed by GPT-6 Astra (xhigh, read-only) three times; all findings fixed.
Docs: docs/privacy.md, docs/releasing.md.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ui/frame_android.py

@@ -106,16 +106,36 @@ def _write_meta(d, meta):
     ssh(f'cat > {d}/meta.json.tmp && mv {d}/meta.json.tmp {d}/meta.json', input=json.dumps(meta, indent=1))
 
 
+# Called after every install, worked or not, as fn(info, meta, error, seconds):
+# info is None if the APK couldn't be read, meta None and error set if it failed.
+install_hooks = []
+
+
 def install(apk_path, flatscreen=True, name=None, source=None, icon_png=None):
-    info = apk_info(apk_path)
-    if icon_png:
-        info['icon_png'] = icon_png
-    check_installable(info)
-    pkg = info['package']
-    if not PKG_RE.match(pkg):
-        raise FrameError(f'unexpected package name {pkg!r}')
-    with _install_lock:
-        return _install(apk_path, info, pkg, flatscreen, name, source)
+    start, info = time.time(), None
+    try:
+        info = apk_info(apk_path)
+        if icon_png:
+            info['icon_png'] = icon_png
+        check_installable(info)
+        pkg = info['package']
+        if not PKG_RE.match(pkg):
+            raise FrameError(f'unexpected package name {pkg!r}')
+        with _install_lock:
+            meta = _install(apk_path, info, pkg, flatscreen, name, source)
+    except FrameError as e:
+        _after_install(info, None, e, start)
+        raise
+    _after_install(info, meta, None, start)
+    return meta
+
+
+def _after_install(info, meta, error, start):
+    for hook in install_hooks:
+        try:
+            hook(info, meta, error, time.time() - start)
+        except Exception:
+            pass  # reporting must never change an install's outcome
 
 
 def _install(apk_path, info, pkg, flatscreen, name, source):