[21/48] OBSERVABILITY: Add per-stage WizCLI telemetry (auth duration, scan duration, output bytes, exit code, client version)

[anota-fernandocosta]

Severity: High (long-term band recommendation; precondition for investigations Wiz-06/07/08)

Evidence

• analyzeWizCLI (api/securitytest/wizcli.go:125) and the scan lifecycle in api/securitytest/securitytest.go::Start record no per-stage timing.
• parseWizCLIJSON (api/securitytest/wizcli.go:379) does not record output size or extraInfo.clientVersion.
• No structured logging in the project (see [33/48] Gap #10: Observability — no structured logging, no /metrics, no /readiness #34).

Impact

Without per-stage telemetry, the team cannot calibrate the 600 s envelope (Probable #8), characterize outage behavior (Probable #7), or judge whether consolidating variants would actually reduce cloud-side load (Probable #9). All three downstream investigations are blocked on this data.

Recommendation

Instrument each WizCLI scan with at minimum:

• wiz.auth_duration_ms
• wiz.scan_duration_ms
• wiz.output_bytes
• wiz.exit_code
• wiz.client_version (extracted from extraInfo.clientVersion in the JSON report, or from a wizcli --version probe in the cmd block)
• wiz.timeout_reason (auth / scan / other) when applicable

Persist alongside existing scan documents in MongoDB so investigations can query historical traffic.

Dependencies

• Pairs naturally with broader observability work in [33/48] Gap #10: Observability — no structured logging, no /metrics, no /readiness #34.
• Should land before Wiz-06/07/08 so those investigations have real data; technically not a hard block.

Cross-references

• Assessment: docs/assessments/wizcli-performance-assessment-01.md — Long-term band ("cloud-scanner telemetry"), Probable findings chore: replace CI/CD with OSS-ready pipeline #7, feat: improve client output readability and Dockerfile #8, docs: update README and CONTRIBUTING for current state #9.
• Existing: [33/48] Gap #10: Observability — no structured logging, no /metrics, no /readiness #34 (broader observability gap).

Verifiable by: New unit tests for telemetry capture; manual scan that emits a populated telemetry document.