feat(daemon): add optional Sentry reporting

[harryisfish]

Summary

• create optional [sentry] daemon config and start Sentry only when a DSN is configured or SMCTL_SENTRY_DSN is provided
• capture core daemon hardware-policy failures while keeping alert webhook/exec failures out of Sentry
• preserve [sentry] across config rewrites and update privacy docs/man page

Privacy / operations

• no project DSN or auth token is committed
• default empty DSN means the SDK does not start
• sendDefaultPii = false, traces_sample_rate = 0 by default, and beforeSend clears user/server-name fields
• SMCTL_SENTRY_DISABLED=1 hard-disables startup for tests or launchd overrides

Validation

• created Sentry project leaperone/smctl via local sentry-cli/API
• dispatched one codex-smoke event and verified it through the Sentry API
• swift test --disable-sandbox
• swift build -c release --disable-sandbox
• git diff --check
• checked release smctld has no @rpath/Sentry.framework runtime dependency