Enforce strict telemetry privacy across shared recovery paths

Strict telemetry-privacy guarantees must be enforced across every shared dependency that can emit events, including retry, recovery, and cleanup paths—not only the caller's primary error handler. This applies when one workflow needs a narrower disclosure boundary than established shared infrastructure. Prefer an explicit least-data mode that emits bounded failure classes and recovery outcomes while preserving the shared helper's existing default for other callers. Test the full error path with credential-shaped synthetic values and assert their absence from every central event.

Limits: bounded event inputs reduce disclosure risk but do not prove that historical logs were clean, that delivery-time processors cannot add data, or that a live log sink behaves as expected; those require separate audits.