fix(cli,core): refresh telemetry posture at the render boundary

R6/R7 blockers.

An already-open Studio kept emitting server-side render telemetry after
another process disabled CLI telemetry. refreshTelemetryPosture() only ran
while serving a fresh SPA document and on /api/telemetry-identity, which
Studio has no consumer for, so the render POST and its async outcome used
the posture cached when the preview server booted. It now refreshes at the
render boundary and again immediately before the completion/error event,
so an opt-out during a long render is honoured.

The identity tests were passing vacuously: their mocks omitted
readConfigFresh and resetTelemetryPostureCache, and the resulting
missing-export error was swallowed by the refresh's own catch. Mocked
properly, plus the enabled -> external disable -> next response transition
and the suppression path at the layer that drops the event.

A full reset also did not persist its new lineage in a long-lived process:
syncInstallState returned early on a process-lifetime memo even after
~/.hyperframes was deleted, so install-state was never recreated and the
next config-only re-mint rolled a third seed instead of inheriting the
second. The memo is now revalidated against the file.

Also drops a stale reference to assertNoOverdueCanaries and stops the
workflow and docs claiming the sunset job routes anything to the owner —
it names them in the run log and notifies nobody.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/core/src/canaryRegistry.ts

@@ -38,8 +38,9 @@ export interface CanaryDefinition {
   /**
    * ISO date after which this canary is overdue for removal. A canary that
    * outlives its rollout is a permanent fork of the product with none of the
-   * review a permanent fork would have received. `assertNoOverdueCanaries`
-   * turns the date into a failing test rather than a good intention.
+   * review a permanent fork would have received. The scheduled `Canary sunset`
+   * workflow runs `scripts/check-canary-sunset.ts` weekly and fails once the
+   * date passes, so this is an enforced deadline rather than a good intention.
    */
   sunsetAfter: string;
 }