fix(cli): address PR review feedback from miguel-heygen

- flushSync: use detached spawn + unref() instead of execFileSync,
  so process.exit() paths don't block up to 5s on slow networks
- showTelemetryNotice: persist notice flag BEFORE printing/tracking,
  so users are never tracked without having seen the disclosure
- Config dir: set mode 0o700 on ~/.hyperframes/ directory (was umask default)
- $ip: null comment: clarify this is belt-and-suspenders with server-side discard
- shouldTrack: update comment — phc_ prefix check is a safety net, not dead code
- env.ts: add comment explaining try/catch fail-safe defaults to production
- init.ts: consistently call trackInitTemplate after scaffoldProject in both paths

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/cli/src/utils/env.ts

@@ -7,6 +7,8 @@ export function isDevMode(): boolean {
     const url = new URL(import.meta.url);
     return url.pathname.endsWith(".ts");
   } catch {
+    // Fail-safe: if URL parsing fails for any reason, assume production.
+    // This ensures telemetry is never accidentally disabled in production builds.
     return false;
   }
 }