chore(hardening): make telemetry opt-in and give the tips fetch a kill switch

[devGregA]

Problem

1. Telemetry was opt-out, and failed open. It ran unless the config said telemetry = false. An install that never made a choice reported by default, and — because the check was !== false — a config that could not be parsed was also treated as consent.
2. The startup tips fetch had no kill switch. Every other launch-time call can be turned off (KIMI_CODE_NO_AUTO_UPDATE, KIMI_DISABLE_TELEMETRY, providing rg/fd locally). The tips banner had none, so an install configured for no outbound traffic still beaconed on every run.

What changed

• Telemetry is enabled only when the config opts in (telemetry = true). An unreadable config is treated as no consent rather than consent. KIMI_DISABLE_TELEMETRY is unchanged and still overrides everything.
• KIMI_CODE_NO_TIPS=1 skips the tips fetch before any network call is made, using the same truthy values as the other switches.

Note this is a fork-local default change: upstream's opt-out choice is theirs to make, and it is easy to see why a product wants it. For a fork run inside one organization, reporting by default is the wrong way round.

Testing

• New: telemetry stays disabled when the config is silent; enables only on explicit opt-in; the tips fetch is skipped (with fetch asserted never called) when the switch is set.
• Updated: the test that asserted telemetry "degrades to enabled when config is unreadable" now asserts it degrades to disabled — that fail-open was part of the problem, so the test was encoding the behaviour being fixed.
• Verified as real tests: with both source files reverted, exactly those 3 fail.
• Full CLI suite green: 196 files / 2665 tests.
• oxlint clean on changed files (one pre-existing warning elsewhere in the file, confirmed on main); tsc --noEmit clean.

Checklist

• Problem explained above (fork-local hardening; no upstream issue).
• Tests added that prove the change works.
• Changeset added (minor).
• No doc update needed.