chore(cli): introduce telemetry and opt-out options

[bespoyasov]

Summary

• Adds anonymous usage telemetry to the CLI, tracking which command was invoked (e.g. flags.list, recordings.policy.create)
• Command names are derived from yargs' parsed argv._, which only contains matched command words — positional values like flag keys or config values are never included
• Telemetry is opt-out via --no-telemetry flag or CONFIDENCE_TELEMETRY=false env var; disabled automatically in CI and test/dev environments
• Centralized in yargs middleware, no per-handler wrappers needed; new commands get tracking for free
• Key acquisition starts eagerly at init (overlaps with command execution) to minimize exit latency
• flush() has a 3s timeout cap so the process never hangs on slow/unreachable telemetry endpoints

Core telemetry changes (packages/core/)

• initTelemetry now requires source (no more implicit 'wizard' default)
• Eager key acquisition via void ensureKey() at client creation
• flush() races pending promises against a 3s timeout with .unref() to avoid blocking exit

CLI integration (packages/cli/)

• telemetryMiddleware inits telemetry, derives the command from argv._, and fires a single invoked event
• bin/cli.ts uses parseAsync() + try/finally { await flushTelemetry() } to flush before exit