Add diagnostics export for beta bug reports

[tdeverx]

Goal

Add an easy diagnostics export/report bundle so beta testers can provide useful, redacted context without manually gathering every detail.

Context

Support guidance asks for version, macOS version, container --version, logs, screenshots, crash snippets, and command output. During beta, reports will be much easier to act on if Contained can gather the safe parts itself and make the remaining manual steps obvious.

Research / design checklist

• Decide where the action belongs: Settings, Help menu, System page, crash/error surfaces, or all of the above.
• Define what the bundle should include: app version/build, update channel, macOS version, architecture, container --version, service status, selected settings, recent activity/log entries, recent errors, and environment summary.
• Define what must be excluded or redacted: registry credentials, env var values, private paths where possible, tokens, passwords, bind mount secrets, and command arguments that may contain secrets.
• Decide the output format: zip, folder, JSON + markdown summary, or .containeddiagnostics package.
• Decide whether users can preview/edit the bundle before sharing.

Implementation checklist

• Implement diagnostics collection through app-owned services rather than ad-hoc view code.
• Add redaction helpers for known sensitive fields.
• Add a user-facing export action with a clear save panel and success/failure feedback.
• Add tests for redaction and stable summary generation where practical.
• Update SUPPORT.md and troubleshooting docs to ask for the diagnostics bundle.

Acceptance criteria

• A beta tester can export useful diagnostics from the app in under a minute.
• The bundle does not include obvious credentials or sensitive values.
• Maintainers can identify app version, CLI version, service state, and recent failure context from the bundle.
• Support docs explain when and how to attach diagnostics.

[tdeverx]

Suggested diagnostics bundle shape

I would make the first version boring and inspectable:

• summary.md: human-readable overview with app version/build, update channel, macOS version, architecture, CLI path source, container --version, service state, and collection timestamp.
• settings.json: selected non-secret settings only, with experimental gates and update/logging configuration.
• activity.json: recent Activity entries, bounded by count/time and redacted.
• errors.log or recent-errors.json: recent user-facing errors and failed command summaries.
• system.json: safe system status fields and resource counts.
• redaction-report.md: what categories were excluded or redacted.

I would avoid including raw command output by default unless it is known-safe or user-previewed. The export UI should say what is included before writing the bundle.

Suggested implementation notes:

• Put collection/redaction in a small service layer, not inside Settings/System views.
• Reuse the privacy audit in Audit privacy, secrets, and logging before 1.0 beta #47 for the redaction rules.
• Prefer a folder or zip with plain files over a custom opaque format for beta.
• Add a “Reveal in Finder” affordance after export.
• Add tests for redacting env-like keys: PASSWORD, TOKEN, SECRET, KEY, AUTH, and registry credential-shaped values.