feat(telemetry): enable session tracking and flush envelopes on exit

[lukeocodes]

Why

Today the `dx-cli` Sentry project has zero events. That's expected for an errors-only telemetry contract on a CLI that's been live <24h — most users haven't hit an unhandled exception. But it also means there's no signal at all: we can't tell "is anyone running v0.2.22?" from the dashboard.

Sessions fix that without violating the errors-only design.

What changed

Two lines in `packages/deepctl-telemetry/src/deepctl_telemetry/client.py`:

```python
sentry_sdk.init(
...
auto_session_tracking=True, # NEW (already the SDK default; explicit now)
traces_sample_rate=0.0, # unchanged
profiles_sample_rate=0.0, # unchanged
...
)

atexit.register(_flush_on_exit) # NEW
```

Plus a tiny module-level helper:

```python
def _flush_on_exit() -> None:
try:
import sentry_sdk
sentry_sdk.flush(timeout=2.0)
except Exception:
pass
```

What it gives us

After the next release lands on PyPI and a few users invoke `dg`:

• Releases dashboard populates with per-version session counts.
• Crash-free session % per release, the canonical CLI health metric.
• Stable signal that "the new version actually launched on someone's machine" without per-command instrumentation.

What it doesn't change

• `traces_sample_rate=0` and `profiles_sample_rate=0` are unchanged — no transactions, no profiles.
• No new PII paths. `before_send` scrubbing applies to error envelopes; session envelopes carry only release tag, environment, and start/end timestamps.
• Opt-out paths (`dg config set telemetry.enabled false`, `DEEPCTL_TELEMETRY_DISABLED=1`, `--non-interactive` once fix(non-interactive): promote CI=1 to hard signal, add --non-interactive flag #67 lands) all skip session tracking too — `init_telemetry` returns early before `atexit.register` is reached, verified by `test_disabled_does_not_register_atexit`.

Why `atexit` and not `Sentry.flush()` inline somewhere

CLI commands have multiple exit paths — `return BaseResult(...)`, raised exceptions, `ctx.exit()` from Click, sys.exit on signal, etc. `atexit` is the only hook that fires on all of them. The 2-second budget caps user-visible exit delay even if Sentry is unreachable. The bare-`except` ensures a Sentry hang can never block process termination.

Test plan

5 new cases in `TestSessionFlush`:

• `test_init_enables_auto_session_tracking` — kwargs dict on `sentry_sdk.init` includes `auto_session_tracking=True` and confirms `traces_sample_rate==0`, `profiles_sample_rate==0` are still in place.
• `test_init_registers_atexit_flush` — `atexit.register` called once with the `_flush_on_exit` function reference.
• `test_disabled_does_not_register_atexit` — when `is_enabled` returns False, neither `sentry_sdk.init` nor `atexit.register` fires.
• `test_flush_on_exit_calls_sentry_flush_with_2s_budget` — `sentry_sdk.flush(timeout=2.0)` is the call shape.
• `test_flush_on_exit_swallows_exceptions` — Sentry raising during flush does not propagate.

Full suite: `uv run pytest packages/deepctl-telemetry/tests/` → 10 passed in 0.06s.