fix(orb): require ORB_ENABLED opt-in for outbound telemetry

[JSONbored]

Motivation

• Restore an explicit opt-in for outbound fleet-calibration telemetry to fix a confidentiality/privacy regression that made Orb export active by default when the GitHub App key was present.
• Update documentation and tests to make the opt-in behavior clear and to prevent regressions.

Description

• Require a truthy ORB_ENABLED env flag before exportOrbBatch will send telemetry by adding a ORB_ENABLED truthy check at the top of exportOrbBatch in src/selfhost/orb-collector.ts.
• Update the runtime comment in src/server.ts to no longer advertise always-on telemetry (Orb is gated by exportOrbBatch/ORB_ENABLED).
• Update .env.example to document the opt-in behavior and add ORB_ENABLED=false as the default documented setting.
• Add regression coverage in test/unit/selfhost-orb-collector.test.ts that asserts export is suppressed when ORB_ENABLED is unset or set to falsey values, and adjust tests to explicitly opt in where needed.

Testing

• Unit tests: ran npx vitest run test/unit/selfhost-orb-collector.test.ts and the test file passed (16/16 tests).
• Typecheck: ran npm run typecheck (tsc --noEmit) and it completed without errors.
• Coverage: attempted npm run test:coverage for the affected test but V8 coverage remapping failed locally due to a dependency version mismatch (ast-v8-to-istanbul / js-tokens), so full coverage run was blocked by the local coverage tool error.
• Dependency audit: npm audit --audit-level=moderate could not complete due to the registry audit endpoint returning 403 Forbidden.

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[JSONbored]

Closing — this reverts a deliberate product decision. Orb telemetry is hardwired on by design (#1257): the self-hosting contract is "install the App, your instance reports anonymized fleet-calibration signal," with no opt-in flag. The privacy posture is already: HMAC anonymization with a dedicated per-instance secret the collector can never reverse, an explicit TELEMETRY NOTICE in .env.example, ORB_AIR_GAP=true as the offline opt-out, and the #1274 registration gate (an instance's data doesn't even count toward the fleet until an operator registers it). Re-introducing ORB_ENABLED opt-in would undo all of that. If we ever want to revisit opt-in vs opt-out as a policy, that's a product call to make deliberately — not via an auto-generated revert. Reopen if that's the intent.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.04%. Comparing base (480f2c3) to head (c746313).
⚠️ Report is 7 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1279   +/-   ##
=======================================
  Coverage   95.04%   95.04%           
=======================================
  Files         177      177           
  Lines       19944    19945    +1     
  Branches     7179     7180    +1     
=======================================
+ Hits        18956    18957    +1     
  Misses        395      395           
  Partials      593      593           

Files with missing lines	Coverage Δ
src/selfhost/orb-collector.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.