feat(cli): move the telemetry row into the shared base — every surface reports

The row moves from web.cordis.yml to base.cordis.yml, so the TUI reports
too (its exit paths already drain: disposeRootAndExit on normal exit, root
dispose before the /resume execve). The TUI launcher applies the same
resolveTelemetryPatch opt-out, judged against the tree actually booting via
configHasTelemetryRow so a --config-replace tree without the row is not
failed by a switch with nothing to disable. The TUI keyless smoke disables
telemetry in its child env; README (en/zh) and the Agent Note pair updated
to the every-surface stance.

apps/cli/tests/tui-keyless-smoke.e2e.ts

@@ -130,7 +130,9 @@ function smoke(overrides: Partial<TuiPtySmokeOptions> & { label: string }): Prom
     tempDirPrefix: 'dsh-tui-smoke-',
     binScript: dshBinScript,
     tsconfigPath,
-    env: { DEEPSEEK_API_KEY: 'keyless-tui-no-call' },
+    // Telemetry now mounts in the shared base: keep fixture sessions from
+    // POSTing to the production endpoint when run outside CI's workflow env.
+    env: { DEEPSEEK_API_KEY: 'keyless-tui-no-call', DSH_TELEMETRY_DISABLED: '1' },
     // Artifact CI builds and smokes concurrently on a contended runner.
     ...(process.env.DSH_EXAMPLE_MODE === 'lib' ? { timeoutMs: 60_000 } : {}),
     ...overrides,