feat: opt-in VSCode privacy + AI-upsell de-nag install profile

[catinspace-au]

Summary

Add an opt-in install option that applies a curated "privacy + de-nag" profile to
the user's VSCode-family editor settings (VSCode, VSCodium, Cursor). The goal:
strip Microsoft's Copilot/AI upsell surfaces and telemetry/online-service callbacks
that ship enabled-by-default, in one idempotent step, so every HyperI dev gets a
clean editor instead of hand-curating settings.json.

This is the "we already worked the settings out, now make it a one-liner" request.
The settings below were verified current as of June 2026.

Problem

Stock VSCode ships AI/Copilot upsell UI and telemetry on by default. New "nasties"
land most releases (title-bar chat button, empty-editor "set up Copilot" hint,
"Generate Commit Message" sparkle, NL settings search phoning home, A/B experiment
fetches). Each has its own toggle and they drift. Devs either don't know or
re-solve it per machine. We want a maintained, versioned profile.

Proposal

An opt-in installer step (e.g. --vscode-privacy flag, or a prompt in the
HyperI section) that merges a managed block into the user settings.json for each
detected editor, idempotently (merge, don't clobber existing keys the user owns).

Detect targets on macOS/Linux/Windows:

• VSCode: ~/Library/Application Support/Code/User/settings.json (and Linux/Win equivalents)
• VSCodium: .../VSCodium/User/settings.json
• Cursor: .../Cursor/User/settings.json

Settings to apply

Tier 1 -- AI / Copilot upsell (the headline ask)

"chat.disableAIFeatures": true,
"chat.commandCenter.enabled": false,
"workbench.editor.empty.hint": "hidden"

chat.disableAIFeatures (VSCode 1.105+) is the master switch -- hides and disables
all built-in AI + Copilot UI, survives updates, and does NOT touch third-party
assistant extensions (Claude Code etc.).

Tier 2 -- Telemetry

"telemetry.telemetryLevel": "off",
"telemetry.feedback.enabled": false

telemetry.telemetryLevel: "off" is the unified switch (supersedes the deprecated
enableTelemetry / enableCrashReporter).

Tier 3 -- Experiments & online-service callbacks

"workbench.enableExperiments": false,
"workbench.settings.enableNaturalLanguageSearch": false,
"extensions.ignoreRecommendations": true,
"npm.fetchOnlinePackageInfo": false,
"json.schemaDownload.enable": false,
"typescript.surveys.enabled": false

(Audit reference: the @tag:usesOnlineServices filter in the Settings UI lists
every networked setting -- generated from VSCode source, good for keeping this
profile current.)

Tier 4 -- Common extension telemetry (apply only if extension present)

"gitlens.telemetry.enabled": false,
"redhat.telemetry.enabled": false,
"python.telemetry.enable": false,
"omnisharp.enableTelemetry": false,
"powershell.telemetry.enable": false,
"debugpy.telemetry.enable": false

Deliberately NOT included (functional, not telemetry)

• extensions.autoUpdate / extensions.autoCheckUpdates -- security updates matter
• update.mode: "none" -- don't freeze the editor

Leave these to the dev. Document them as commented options.

Implementation notes

• Merge semantics: only set keys we manage; never delete user keys. Idempotent re-run.
• Back up settings.json before first write.
• A --vscode-privacy=off / uninstall path that removes only our managed keys.
• Keep the profile in one source file so updates ship via the existing auto-update
  channel (this is the maintained-not-a-gist value-add over a one-off dotfile).
• "Nuclear option" note in docs: VSCodium is the build-time-stripped alternative.

Why both repos

• hyperi-developer: this is the "standardised auto-updating dev environment" --
  natural home for the installer step.
• hyperi-ai: belongs as a documented standard / recommended editor baseline so
  the setting list has an SSoT to point at.