#1235 CLI telemetry: fold third-level verbs into subcommand + canonicalize aliases

Problem

The scoring retier (step 2 of the command-tier work) is limited by what the CLI sends. Two gaps, both go-forward:

1. Third-level verbs are invisible. extractCommandInfo records only two tokens — command + subcommand — and puts the third verb into the redacted args array, which never reaches the server's day rollup. So workflow run and workflow run search arrive as identical events, and model method run / describe / history are indistinguishable. Tier values can only key on the 2-token pair, so reads/polling under a group inherit the tier of the work command (e.g. run-status polling scores like running a workflow).

2. Aliases key as typed. Telemetry records the raw argv token, so vault write-secret and vault put arrive as different subcommands and score differently unless every alias spelling gets its own tier entry.

Proposed solution

In extractCommandInfo (src/cli/telemetry_integration.ts):

• For known group commands (model method, model output, model type, workflow run, workflow history, workflow schema, vault type, datastore type/namespace/catalog/lock/setup, extension trust/source, access token/grant/group, worker token/daemon, serve daemon, report type), fold the third token into subcommand (space-joined, e.g. subcommand: "run search").
• Canonicalize alias tokens to the resolved command name before recording (write-secret → put, status → whoami, comment → ripple, ls/remove → list/rm, summarize → summarise, hidden list aliases → search).

Go-forward only — no recovery. Old binaries keep emitting the 2-token/typed shape indefinitely and continue to score via the 2-token tier fallback; new binaries emit the compound/canonical shape and get the finer tiers. Both shapes coexist; no backfill, no restamping, nothing reprocessed. Server-side this is purely additive: new (command, subcommand) grains in cli_daily, new tier entries in the projector CTE.

Alternatives considered

• Server-side mapping: impossible — the distinction never arrives (third token is redacted client-side).
• Alias tier entries only: works for aliases (and is the interim mitigation) but does nothing for third-level verbs.