fix(selfhost): move Sentry init before emptyConfigDirAdvisory so it can alert too

[JSONbored]

Summary

Follow-up to #6325 (#6350), which fixed sqliteBackupAdvisory and publicOriginReachabilityAdvisory the same way — both switched from console.warn to console.error, since installStructuredLogForwarding only ever intercepts console.log (with an explicit level:error/fatal) and console.error (always forwarded), never console.warn.

emptyConfigDirAdvisory has the identical bug, but the same one-line swap wasn't enough for it: it fires before initSentry runs, so the forwarding hook doesn't exist yet at that point in the boot sequence — a console.error there would have reached nothing regardless.

• Moves the Sentry/OpenTelemetry init block to run immediately after loadFileSecrets()/assertSelfHostPreflight() — before every boot-time advisory, not just this one — then applies the same console.warn → console.error swap to emptyConfigDirAdvisory.
• Kept right after those two specifically: a self-host SENTRY_DSN is commonly supplied via a mounted secret file loadFileSecrets() reads into process.env, and preflight is a fatal-exit gate that should run before anything else regardless of Sentry's own state.
• Everything else that used to sit between the old and new positions (the metrics mode flag, the LOOPOVER_REPO_CONFIG_DIR manifest/review-context readers, the selfhost_config_dir info log) has no ordering dependency on Sentry either way — confirmed by reading through all of it. The info log in particular has no level field, so the forwarder would ignore it even with the hook now active earlier.

Advances #6325 (doesn't close it — the live PUBLIC_API_ORIGIN misconfiguration on the self-hosted instance is still the remaining piece, pending your infra decision).

Test plan

• test/unit/selfhost-health.test.ts (the pure emptyConfigDirAdvisory function tests, untouched by this wiring-only change) — 36 tests pass unchanged
• test/unit/docs-selfhost-sentry-observability.test.ts — 4 tests pass unchanged
• src/server.ts is Codecov-exempt (see codecov.yml's ignore: list), so this doesn't need new coverage
• The build + boot smoke test CI workflow (.github/workflows/selfhost.yml) actually boots the real container and checks /health, /ready, /metrics, and the migration log line — none of which depend on this reorder, and SENTRY_DSN isn't set in that smoke test's env anyway, so initSentry no-ops there regardless of position
• npm run typecheck clean
• Full local npm run test:ci gate green

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.60%. Comparing base (6870c87) to head (01e8cad).
⚠️ Report is 17 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6359   +/-   ##
=======================================
  Coverage   95.60%   95.60%           
=======================================
  Files         598      598           
  Lines       47201    47201           
  Branches    15022    15022           
=======================================
  Hits        45127    45127           
  Misses       1290     1290           
  Partials      784      784           

Flag	Coverage Δ
shard-1	43.97% <ø> (-0.19%)	⬇️
shard-2	36.80% <ø> (+0.41%)	⬆️
shard-3	32.53% <ø> (ø)
shard-4	34.43% <ø> (-0.19%)	⬇️
shard-5	30.99% <ø> (-0.59%)	⬇️
shard-6	45.30% <ø> (+0.43%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.