Fold `sampler.enabled` into `mode = "record"` (deja recording config)

Record mode is meaningless without the per-request sampler: a record-mode process with the sampler disabled should not be representable.

Collapse the two knobs so that `mode = "record"` implies the sampler, and drop (or derive) the separate `[deja.sampler] enabled` flag from the settings surface introduced by the recording-sink/boot PR. This is a pure config-surface simplification with no behavior change for a correctly-configured deployment — it just removes a footgun state (`mode = "record"` + `sampler.enabled = false`) that can only misconfigure a recording fleet.

Start with the recording-sink/boot settings surface mentioned in the issue and trace how mode and sampler.enabled are represented. Check the existing configuration behavior for record mode, then remove or derive the separate enabled flag while preserving correctly configured deployments. Done means the invalid record-plus-disabled-sampler state is no longer representable.

Written by the indexing model from the issue text.