Global telemetry opt-out does not suppress sponsor usage metering

Summary

Jcode's global telemetry opt-outs do not suppress sponsored-discovery usage metering. With sponsors enabled, sponsored MCP/tool provenance can still send connect, call, and error reports even when JCODE_NO_TELEMETRY, DO_NOT_TRACK, or the no-telemetry marker disables ordinary telemetry.

Why this matters

From an operator privacy boundary, both paths are product-originated usage reporting. A global telemetry/privacy opt-out should either cover all such egress or the sponsor channel should require separate, explicit consent with clear UI and documentation.

Today the two controls can produce a surprising state: ordinary telemetry reports disabled while sponsored usage reports remain enabled.

Source trace

Audited at 008abc44b1653efa65ccf98acb3b7236ce8507e6:

• Ordinary telemetry's is_enabled honors the environment and marker-file opt-outs.
• Sponsored provenance/reporting checks sponsors.enabled independently.
• The sponsor path emits session/day/connect/call/error usage reports in provenance.rs.

Reproduction shape

1. Leave sponsored discovery enabled.
2. Set JCODE_NO_TELEMETRY=1, DO_NOT_TRACK=1, or create the no-telemetry marker.
3. Use a discovery-tagged sponsored MCP/tool.
4. Observe that the sponsor reporting path remains eligible to send usage events because it does not consult the telemetry/privacy opt-out.

Expected behavior

One of these contracts should be explicit and enforced:

1. Global privacy opt-out suppresses ordinary telemetry and sponsored usage metering, or
2. Sponsored metering is a separately consented feature that is off until the operator explicitly enables it.

In either case, status/doctor output should show every outbound usage-reporting channel and its effective state.

Suggested regression

Add a no-network unit test around the sponsor reporter that enables sponsors, activates each global opt-out mechanism, triggers a sponsored call, and asserts that no report is queued or sent.

Start in crates/jcode-telemetry-core/src/lib.rs, where is_enabled handles environment and marker-file opt-outs, then compare it with the sponsors.enabled and reporting logic in crates/jcode-base/src/sponsors/provenance.rs. Add a no-network regression test covering each global opt-out during a sponsored call. Done means the chosen consent contract is enforced and status/doctor output reflects every outbound usage-reporting channel.