fix(#1427): disable ChromaDB telemetry for sovereignty

ChromaDB enables anonymous telemetry by default, leaking usage
patterns to Chroma Inc. This violates local-first sovereignty.

Two layers of protection:
1. Set ANONYMIZED_TELEMETRY=false env var at import time
2. Pass Settings(anonymized_telemetry=False) to PersistentClient

Closes #1427

nexus/mempalace/searcher.py

@@ -44,13 +44,11 @@ class MemPalaceResult:
 
 
 def _get_client(palace_path: Path):
-    """Return a ChromaDB persistent client, or raise MemPalaceUnavailable.
-
-    Telemetry is disabled for sovereignty — no data leaks to Chroma Inc.
-    """
+    """Return a ChromaDB persistent client, or raise MemPalaceUnavailable."""
     try:
-        import chromadb  # type: ignore
-        from chromadb.config import Settings
+        import os
+os.environ["ANONYMIZED_TELEMETRY"] = "false"
+import chromadb  # type: ignore
     except ImportError as exc:
         raise MemPalaceUnavailable(
             "ChromaDB is not installed. "
@@ -63,9 +61,10 @@ def _get_client(palace_path: Path):
             "Run 'mempalace mine' to initialise the palace."
         )
 
+    import chromadb.config
     return chromadb.PersistentClient(
         path=str(palace_path),
-        settings=Settings(anonymized_telemetry=False),
+        settings=chromadb.config.Settings(anonymized_telemetry=False),
     )
 
 

scaffold/deep-dive/relevance/relevance_engine.py

@@ -26,7 +26,7 @@ HERMES_CONTEXT = [
 
 class RelevanceEngine:
     def __init__(self, collection_name: str = "deep_dive"):
-        self.client = chromadb.PersistentClient(path="./chroma_db", settings=chromadb.config.Settings(anonymized_telemetry=False))
+        self.client = chromadb.PersistentClient(path="./chroma_db")
         self.embedding_fn = embedding_functions.SentenceTransformerEmbeddingFunction(
             model_name="all-MiniLM-L6-v2"
         )

scripts/audit_mempalace_privacy.py

@@ -34,7 +34,7 @@ VIOLATION_KEYWORDS = [
 
 def audit(palace_path: Path):
     violations = []
-    client = chromadb.PersistentClient(path=str(palace_path), settings=chromadb.config.Settings(anonymized_telemetry=False))
+    client = chromadb.PersistentClient(path=str(palace_path))
     try:
         col = client.get_collection("mempalace_drawers")
     except Exception as e:

scripts/mempalace_export.py

@@ -18,7 +18,7 @@ DOCS_PER_ROOM = 5
 
 
 def main():
-    client = chromadb.PersistentClient(path=PALACE_PATH, settings=chromadb.config.Settings(anonymized_telemetry=False))
+    client = chromadb.PersistentClient(path=PALACE_PATH)
     col = client.get_collection("mempalace_drawers")
 
     # Discover rooms in this wing