fix(web): review round 1 — loud opt-out, headless drain, scaffold isolation, docs

- resolveTelemetryPatch: extracted pure switch resolution (unit-tested);
  fails loud when DSH_TELEMETRY_DISABLED is set but the row is absent, and
  documents that ANY non-empty value (including '0'/'false') disables.
- runHeadless: SIGINT/SIGTERM now dispose the tree before exit so the
  telemetry tail and shutdown marker drain (Node's default signal exit
  skips disposal).
- web.cordis.yml: explicit maxQueueSize beside maxExportBatchSize (the
  single-batch drain invariant no longer leans on an SDK default), comment
  covers exportTimeoutMillis's role and links the Agent Note.
- apps/web scaffold: disable telemetry-otel — fixture sessions must never
  leave the process.
- apps/cli README (en/zh + pairing): document the default endpoint, both
  env seams, and the no-redaction disclosure.

apps/cli/config/web.cordis.yml

@@ -111,15 +111,21 @@
     # Session telemetry: mirrors every session-log event (assistant/chunk
     # projected to first-of-step) plus ops markers onto OTLP/HTTP log records,
     # streaming on the batch processor's cadence (10s/batch here) — not at
-    # exit; a crash loses at most the last unexported interval.
+    # exit; a crash loses at most the last unexported interval. No
+    # telemetry/record redaction rule is mounted yet, so exports are the raw
+    # captured copy; the deployment stance, env seams, and follow-ups are
+    # pinned in the web-telemetry-default-mount Agent Note.
     # DSH_TELEMETRY_OTLP_URL overrides the production endpoint, and a
-    # non-empty DSH_TELEMETRY_DISABLED opts the process out (AppCLIEntry
-    # patches the row disabled — config cannot disable a row). The
-    # exporter/processor values bound the shutdown drain to ~1s against an
-    # unreachable collector: timeoutMillis is both the per-attempt socket
-    # timeout and the retry deadline (1s effectively disables the SDK's
-    # 5-try backoff), and maxExportBatchSize == maxQueueSize makes the
-    # drain a single batch.
+    # non-empty DSH_TELEMETRY_DISABLED — any value, including '0'/'false' —
+    # opts the process out (AppCLIEntry patches the row disabled; config
+    # cannot disable a row). The exporter/processor values bound the
+    # shutdown drain to ~1s against an unreachable collector:
+    # exporter.timeoutMillis is both the per-attempt socket timeout and the
+    # retry deadline (1s effectively disables the SDK's 5-try backoff),
+    # maxExportBatchSize == maxQueueSize (both explicit) makes the drain a
+    # single batch, and exportTimeoutMillis is the processor's own cap on
+    # that one export cycle — the second bound when the exporter's clock
+    # alone does not fire.
     - id: telemetry-otel
       name: '@deepseek-ai/dsh-session-telemetry-otel'
       config:
@@ -129,6 +135,7 @@
           timeoutMillis: 1000
         processor:
           scheduledDelayMillis: 10000
+          maxQueueSize: 2048
           maxExportBatchSize: 2048
           exportTimeoutMillis: 1500