[codex] Track release provenance and opt-in telemetry roadmap

[toby-bridges]

Summary

• record the v2.3.0 release artifact verification false alarm caused by hashing a CRLF-converted Windows working-tree file instead of the Git tag blob
• document release artifact provenance hardening as a follow-up
• document a privacy-first, opt-in usage telemetry candidate for future active-install and step-failure visibility
• gate any future remote telemetry behind release artifact provenance work

Validation

• git diff --check
• docs-only change; no pytest run