feat(analytics): instance census, full capture, richer error context (#511)

Add a once-per-boot instance_started event (arch, os, deploy_mode,
gpu_present) so the fleet architecture mix is measurable. It reuses the
existing per-instance instance_id and is exempt from the volume sample
rate, since a census that fires once per boot must not be thinned.

Restore useful capture depth now that the sponsored plan removes the
quota pressure behind the earlier hardening:

- PostHog sample rate 0.1 to 1.0 (full analytics when enabled); the
  property allowlist still blocks file data.
- Sentry per-instance ceiling 20 to 500/hr, breadcrumb trail restored
  (sanitized: urls/paths redacted, data payloads dropped), full stack
  paths kept; local vars, request bodies, and PII still dropped. Both
  api and web.

Honor ANALYTICS_ENABLED=false as an opt-out alias: it was documented on
the Docker Hub README but never wired in 2.x, so anyone who set it was
still tracked.

All capture stays behind the analytics opt-out gate.

scripts/bake-analytics.mjs

@@ -24,7 +24,10 @@ const posthogHost = posthogApiKey ? "https://us.i.posthog.com" : "";
 const enabled = on && (posthogApiKey !== "" || sentryDsn !== "" || sentryDsnWeb !== "");
 // PostHog event sampling only. Sentry tracing was removed in 2.0.1; do not
 // reintroduce a shared "sampleRate" that doubles as a traces rate.
-const posthogSampleRate = on ? 0.1 : 0;
+// 1.0 = full analytics when enabled: the property allowlist (analytics-allowlist.ts)
+// already blocks file data, and PostHog event volume is cheap under the sponsored
+// plan. The old 0.1 was an inherited Sentry-tracing cost figure, not an event rate.
+const posthogSampleRate = on ? 1.0 : 0;
 
 const content = `// AUTO-GENERATED by scripts/bake-analytics.mjs -- do not edit manually
 export const ANALYTICS_BAKED = {