Add hook timestamp to telemetry reporting

[rishiy15]

Summary

Adds a ts (epoch-milliseconds) field to both telemetry event schemas (agent_hook_execution and agent_hook_install), stamping when each hook fired. The 1Password app maps this to the Snowplow device-created timestamp, giving downstream analytics an accurate event time rather than relying on ingestion time.

Changes

• lib/telemetry.sh
  • New ts_json_fragment() helper that produces the ,"ts":<epoch_ms> JSON fragment from current_time_ms(). It's guarded by a numeric regex check, so an unreadable/non-numeric clock yields an empty string instead of a malformed JSON line.
  • write_execution_event() and write_install_event() now append the ts fragment to their emitted JSON lines.
• tests/lib/telemetry.bats
  • Asserts ts is present and an unquoted integer (so it parses as a JSON number, not a string) in both execution and install events.
  • Adds a full JSON-parse check (via python3, when available) for the install event to confirm the line stays valid with the new field.
  • Clarifies the file-size-cap test comment.

Testing Done

• Ran the full bats tests/lib/telemetry.bats suite — all 31 tests pass.
• ts present (happy path): With a readable clock, both write_execution_event and write_install_event emit "ts":<int>. Tests assert the value is an unquoted integer (\"ts\":[0-9]+) and explicitly reject a quoted string ("ts":"...") so it deserializes as a JSON number, and the install event is round-tripped through python3 json.loads` to confirm the full line is still valid JSON.
• ts absent (backwards compatibility): ts_json_fragment() returns an empty string when current_time_ms() yields a non-numeric/unreadable value, so the field is simply omitted. The resulting event line is identical to the pre-change schema, which the existing structure tests continue to cover. Consumers must treat ts as optional — events from older hook bundles, or from a host with an unreadable clock, will not carry it.
• Schema compatibility: ts is purely additive — no existing field changed name, type, or position — so older parsers ignoring unknown keys are unaffected.

Notes

• The ts field is optional by construction — if the clock can't be read, the field is omitted and the rest of the event is unaffected.