fix(telemetry): discard malformed UTF-8 uploads

[steipete]

Malformed UTF-8 in an optional feature-statistics upload was silently replaced during decoding, allowing an invalid JSON byte stream to count as opted-in telemetry and contribute plugin/session counts. Reject decoding errors before JSON parsing so the existing malformed-body path drops all feature statistics while the version check still succeeds.

The upload size limit and valid Unicode handling are preserved. Update the collection documentation and changelog, and add regression coverage for invalid leading bytes, overlong encodings, incomplete sequences, encoded surrogates, and valid multibyte characters split across chunks.

Validation: the four malformed-byte parser cases and a bundled workerd test over real local HTTP failed before the fix. All 407 tests now pass with npm run check, and npx wrangler deploy --dry-run succeeds. The HTTP test verifies that malformed input still receives a version answer and records no opted-in feature fields. Independent autoreview found no actionable P0–P2 issues. All request bodies and the npm upstream response in runtime tests are synthetic.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix(telemetry): discard malformed UTF-8 uploads This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

[steipete]

Landed as d57a652.

Verification: npm run check passed vocabulary consistency, typechecking, and all 407 tests; npx wrangler deploy --dry-run succeeded. Four malformed UTF-8 parser regressions and the bundled workerd regression over real local HTTP failed before the fix and pass afterward. The HTTP proof verifies a successful version answer with no opted-in feature fields recorded. Valid multibyte Unicode split across chunks is also covered. Requests and the npm upstream response were synthetic; no production telemetry was sent for testing.

Independent P0–P2 autoreview was clean. Both the PR validation run and CodeQL run succeeded on exact head b86d4a0 before squash merge, without CI retries or ruleset bypasses.