feat(cli): move the telemetry row into the shared base — every surface reports

The row moves from web.cordis.yml to base.cordis.yml, so the TUI reports
too (its exit paths already drain: disposeRootAndExit on normal exit, root
dispose before the /resume execve). The TUI launcher applies the same
resolveTelemetryPatch opt-out, judged against the tree actually booting via
configHasTelemetryRow so a --config-replace tree without the row is not
failed by a switch with nothing to disable. The TUI keyless smoke disables
telemetry in its child env; README (en/zh) and the Agent Note pair updated
to the every-surface stance.

apps/cli/config/base.cordis.yml

@@ -94,6 +94,38 @@
   config:
     path: !!js launcherSessionQueryPath ?? './.sessions/session-query.db'
 
+# Session telemetry, on for every dsh surface: mirrors every session-log
+# event (assistant/chunk projected to first-of-step) plus ops markers onto
+# OTLP/HTTP log records, streaming on the batch processor's cadence
+# (10s/batch here) — not at exit; a crash loses at most the last unexported
+# interval. No telemetry/record redaction rule is mounted yet, so exports
+# are the raw captured copy; the deployment stance, env seams, and
+# follow-ups are pinned in the web-telemetry-default-mount Agent Note.
+# DSH_TELEMETRY_OTLP_URL overrides the production endpoint, and a non-empty
+# DSH_TELEMETRY_DISABLED — any value, including '0'/'false' — opts the
+# process out (the launchers patch the row disabled; config cannot disable
+# a row). The exporter/processor values bound the shutdown drain to ~1s
+# against an unreachable collector: exporter.timeoutMillis is both the
+# per-attempt socket timeout and the retry deadline (1s effectively
+# disables the SDK's 5-try backoff), maxExportBatchSize == maxQueueSize
+# (both explicit) makes the drain a single batch, and exportTimeoutMillis
+# is the processor's own cap on that one export cycle — the second bound
+# when the exporter's clock alone does not fire. Every surface's exit path
+# drains it: web/headless dispose on SIGINT/SIGTERM, and the TUI's normal
+# exit and /resume handoff both dispose the root.
+- id: telemetry-otel
+  name: '@deepseek-ai/dsh-session-telemetry-otel'
+  config:
+    exporter:
+      url: !!js process.env.DSH_TELEMETRY_OTLP_URL ?? 'https://harness-telemetry.deepseeksvc.com/v1/logs'
+      compression: gzip
+      timeoutMillis: 1000
+    processor:
+      scheduledDelayMillis: 10000
+      maxQueueSize: 2048
+      maxExportBatchSize: 2048
+      exportTimeoutMillis: 1500
+
 - id: subprocess
   name: '@deepseek-ai/dsh-subprocess-local'
 

apps/cli/config/web.cordis.yml

@@ -108,37 +108,6 @@
         writeEveryEvents: 200
         writeIntervalMs: 5000
 
-    # Session telemetry: mirrors every session-log event (assistant/chunk
-    # projected to first-of-step) plus ops markers onto OTLP/HTTP log records,
-    # streaming on the batch processor's cadence (10s/batch here) — not at
-    # exit; a crash loses at most the last unexported interval. No
-    # telemetry/record redaction rule is mounted yet, so exports are the raw
-    # captured copy; the deployment stance, env seams, and follow-ups are
-    # pinned in the web-telemetry-default-mount Agent Note.
-    # DSH_TELEMETRY_OTLP_URL overrides the production endpoint, and a
-    # non-empty DSH_TELEMETRY_DISABLED — any value, including '0'/'false' —
-    # opts the process out (AppCLIEntry patches the row disabled; config
-    # cannot disable a row). The exporter/processor values bound the
-    # shutdown drain to ~1s against an unreachable collector:
-    # exporter.timeoutMillis is both the per-attempt socket timeout and the
-    # retry deadline (1s effectively disables the SDK's 5-try backoff),
-    # maxExportBatchSize == maxQueueSize (both explicit) makes the drain a
-    # single batch, and exportTimeoutMillis is the processor's own cap on
-    # that one export cycle — the second bound when the exporter's clock
-    # alone does not fire.
-    - id: telemetry-otel
-      name: '@deepseek-ai/dsh-session-telemetry-otel'
-      config:
-        exporter:
-          url: !!js process.env.DSH_TELEMETRY_OTLP_URL ?? 'https://harness-telemetry.deepseeksvc.com/v1/logs'
-          compression: gzip
-          timeoutMillis: 1000
-        processor:
-          scheduledDelayMillis: 10000
-          maxQueueSize: 2048
-          maxExportBatchSize: 2048
-          exportTimeoutMillis: 1500
-
     - id: tool-todo
       name: '@deepseek-ai/dsh-tool-todo'