chore: sync current privacy-first AgentOps release

[c-mongan]

Summary

• sync the current privacy-first AgentOps implementation into the existing public repository without importing private Git history
• remove private Azure identifiers, operational evidence, machine paths, and live screenshots
• require explicit fail-closed Azure subscription targeting and allowlisting across JS, Bash, and PowerShell paths
• harden npm package contents, clean-export checks, release identity checks, and pinned CI actions

Verification

• 632 tests: 631 passed, 0 failed, 1 skipped
• coverage gate passed
• clean-export tests and local doctor passed
• CLI and SDK publish checks passed; both packages include MIT LICENSE text
• install, Homebrew, packaged lifecycle, static, security audit/posture, JSON, shell syntax, privacy poison, and Gitleaks checks passed
• independent security and packaging reviews passed on the staged candidate

Scope and limitations

• local/offline checks do not claim live Azure validation
• Azure writes remain disabled unless both AGENTOPS_AZURE_SUBSCRIPTION_ID and AGENTOPS_APPROVED_AZURE_SUBSCRIPTION_IDS explicitly authorize the active subscription
• experimental features remain labelled