I think the kind of data Package Control collects is kind of to be expected for such a feature. As long as communication about it is clear it's fine, so to me part 2 of the proposal is fine.
What's happening with SidebarEnhancements (and Minimap for Atom), is that the telemetry has no relation at all with the functionality of the package. It's just a way to sneak in on as many developers as possible.
I feel there should be a clear value-add for the user of the package, and it should be there in the very first version that's submitted to the default channel. If the telemetry is essential, it doesn't make sense to add it on later. If it's not essential and the package maintainer is simply curious, that's too weak a use case to allow the telemetry. There should be zero tolerance for packages that add, after submission, anything that takes any kind of information from the end user and uploads it elsewhere. Sublime has a large user base so of course it's enticing, but Package Control should not be treated as a commercial opportunity. It originated from the community and it exists so that the community can share, not as an entry point for Kite et al. to mine data.
Therefore, I would add the following to point 1 of the proposal:
If a new package is submitted that uses telemetry, it should be opt-in and clearly, very explicitly explained to end users. The pull request that adds the package to the default channel should clearly mention the telemetry, how it relates to the core functionality of the package, and the efforts undertaken to explain this to end users. If there is no strong relation between the telemetry and the features of the package, it will not be allowed. Any package that is found to add telemetry after being added to the default channel will be pulled immediately and only restored after the telemetry code is removed.
This still allows anyone to create a new version of an existing package with telemetry, but challenges them to create a new entry in Package Control and convince the user base to migrate based on the value-add of the telemetry. If SidebarEnhancements-with-Kite is much better than the old one there should be no problem with this approach.
I would consider adding similar rules about advertising: it's only a matter of time Kite hijacks something else (the linter seems like a tasty target, I bet they've already been approached) to add links to their services like it did with Minimap for Atom. Any advertising that's not a donation button or a link to a repository should follow the same rules: add value, improve the core functionality, add it on day one, don't be sneaky.
Edit: When in doubt about the value-add, default to "no". Something like Package Control cannot flourish if people don't feel safe about it, but I doubt we'd miss out much if a package or two is rejected. Plus, you can always create a new channel.