fix(security): sanitize telemetry data + add SHA-256 verification for model downloads

[MAXDVVV]

Summary

This PR addresses two security concerns in Open Interpreter:

1. Telemetry Data Sanitization (telemetry.py)

Problem: The send_telemetry() function sends properties to PostHog without any sanitization. When exception stack traces or other debug data are included in telemetry properties, they may inadvertently leak:

• Absolute file paths revealing usernames and directory structures
• Environment variable values
• API keys, tokens, or passwords embedded in error messages

Fix: Added a _sanitize_properties() layer that:

• Strips absolute file paths (Unix /home/user/... and Windows C:\Users\...) → <path>
• Redacts environment variable references ($HOME, %USERPROFILE%) → <env>
• Redacts values of sensitive keys (api_key, password, token, etc.) → <redacted>
• Recursively processes nested dicts and lists

2. Model Download Integrity Verification (local_setup.py + new download_security.py)

Problem: Model files (multi-GB executables) are downloaded via wget.download() from HuggingFace URLs with zero integrity verification. A network-level attacker (MITM) or compromised CDN could serve tampered model files that get chmod +x and executed.

Fix:

• New download_security.py module with verify_model_integrity() function
• Computes SHA-256 hash of downloaded files
• Verifies against expected hash when available
• Warns users when no hash is available (prints computed hash for manual verification)
• Automatically removes files that fail integrity checks
• Added sha256 field to all model entries in the model list (currently None — maintainers should populate with verified hashes)

Files Changed

File	Change
interpreter/core/utils/telemetry.py	Added sanitization layer before requests.post()
interpreter/terminal_interface/download_security.py	New — SHA-256 verification utility
interpreter/terminal_interface/local_setup.py	Import + call verify_model_integrity() after download

Testing

• Sanitization is regex-based with no external dependencies
• Hash verification uses only stdlib hashlib
• No breaking changes — all existing behavior preserved
• When sha256 is None, download proceeds with a warning (non-blocking)

Next Steps (for maintainers)

Populate the sha256 field for each model entry with verified checksums from HuggingFace. Example:

{
    "name": "Llama-3.1-8B-Instruct",
    "sha256": "abc123...",  # from HuggingFace model card
    ...
}