open-file fallback sends local filesystem paths to react-grab.com; telemetry undocumented in README

## Summary

Two related privacy/disclosure items from a security review:

### 1. Local file path transmitted to vendor server (Medium)

`packages/react-grab/src/utils/open-file.ts:7,42-44` — when the dev-server open fails in production mode, the code calls:

```js
window.open("https://react-grab.com/open-file?url=&line=N")
```

This transmits the user's **local filesystem path** (which often contains usernames, project names, and directory structure) to a third-party server as URL parameters.

Suggested fix: route through the local CLI/daemon instead, or strip to project-relative paths before constructing the URL.

### 2. Telemetry not disclosed in README

The browser package sends an anonymous `{source=browser, v, t}` version ping on init (`src/core/log-intro.ts:13-19`, opt-out via `telemetry: false`), and the CLI sends a `{source=cli}` ping plus an init report POSTing framework/package-manager/router info and error stack traces to `react-grab.com/api/report-cli` (`packages/cli/src/commands/init.ts:33,44-57`; `DO_NOT_TRACK` respected). None of this is mentioned in the README. Sibling projects handle disclosure well (react-doctor's telemetry README section), so react-grab should match that bar — especially given agents are instructed by SKILL.md to auto-run `npx react-grab@latest pull`.

## Credit where due

The rest of the egress story is solid: opt-outs exist for every path (`telemetry: false`, `DO_NOT_TRACK`), captured grabs stay on-device in a 0700 dir with symlink/ownership refusal, clipboard parsing treats hostile input as untrusted, no lifecycle scripts, npm provenance attested.