I must reverse my preference on implementation. Unpacking and reading the contents of the apk is quite doable and requires no additional permissions. However, the only practical mechanism I know of for the seemingly simple task of locating the original ROM apk requires the android.permission.DUMP permission which is inadvisable. We can manually search for our own apk but this may be error prone. For this reason, I recommend approach #2. If we're willing to tolerate some failures or cannot add a permission, #1 is doable.

1. Unpack the ID from the original apk file.
   
   Pro:
   • No additional permission is necessary.
     
     Con:
   • Manually finding the apk may be unreliable if the apk file is renamed.

2. Add a distinct ACTION_BOOT_COMPLETED broadcast receiver and permission. Record and / or transmit the preload ID. Disable the broadcast receiver so subsequent boots are unaffected. Note: this intent will not be received for store installs.
   
   Pro:
   • It's possible to identify the number of users with the preinstall that don't actually use the app.
   • Implementation should be reliable and cleaner than alternatives.
     
     Con:
   • An extra permission is necessary.

We're going with strategy #2

Change 264409 had a related patch set uploaded (by Niedzielski):
Retain preload channel ID

https://gerrit.wikimedia.org/r/264409

Change 264409 merged by jenkins-bot:
Retain preload channel ID

https://gerrit.wikimedia.org/r/264409