fix(telemetry): resolve race conditions, duplicate turns, and consent defaults

- Rewrite collector to Instance.state-scoped with dataLevel filtering and
  messageId deduplication to prevent duplicate turn finalizations
- Fix integration user-message race by retrying after 50ms when parts are
  empty; use MessageV2.Event.Updated with time.completed instead of
  step-finish; clean up turnStartTimes entries; add SIGTERM/beforeExit flush
- Fix Session.Event.Diff handler to use Snapshot.FileDiff shape (file,
  additions, deletions) instead of non-existent type/hunks/path fields
- Rewrite consent to default OFF until explicit opt-in; add setLocalConsent
  and loadLocalConsent for KV store integration; add CODEQ_DISABLE_TELEMETRY
  env var kill switch via Flag namespace
- Export setConsent/loadConsent from telemetry barrel

Author: Kenny-Heitritter

packages/opencode/src/flag/flag.ts

@@ -51,6 +51,9 @@ export namespace Flag {
   export const OPENCODE_MODELS_URL = process.env["OPENCODE_MODELS_URL"]
   export const OPENCODE_MODELS_PATH = process.env["OPENCODE_MODELS_PATH"]
 
+  // qBraid / CodeQ flags
+  export const CODEQ_DISABLE_TELEMETRY = truthy("CODEQ_DISABLE_TELEMETRY")
+
   function number(key: string) {
     const value = process.env[key]
     if (!value) return undefined