Sentry: reset exit-telemetry anchors on toggle cycle (§9b.9)

[gmaclennan]

Part of #74. Re-scoped after PR #111 — the user.id half landed there; this issue now covers only the anchor resets.

Landed in #111 (design updated from the original spec): identity is anchored on a short root user ID (XXXX-XXXX-XXXX, base32 without ambiguous characters, generated lazily, stored in on-device settings so uninstall resets identity). Sentry user.id is always a hash derived from it — monthly-rotating (sha256(root|YYYY-MM)) by default, permanent (sha256(root|permanent)) under the applicationUsageData opt-in; the raw root ID is never sent. Same value on all three SDKs (native-computed, sentryConfig.userId to JS, --sentryUserId to Node), locked against host override. getRootUserId() exposes the root ID for a debug/about screen so a user can share it and support can recompute their historical IDs. See docs/sentry-integration.md §9.2 "Sentry user.id".

Remaining (§9b.9): when diagnosticsEnabled or applicationUsageData flips off → on, the app-exit tracking high-water timestamps should reset to "now" so exit records generated during the off window are never reported after re-enable. Today the setters persist the toggle but don't touch the anchors, so a re-enable can surface exits from the period the user had opted out of.

Done when

• setDiagnosticsEnabled / setApplicationUsageData (both platforms) reset the exit-reason high-water mark and duration anchors on an off → on transition
• Unit tests: records dated inside the off window are not reported after re-enable; records after re-enable are

[gmaclennan]

Re-scoped: the installation-ID / user.id rotation half landed with PR #111 (as a short root user ID with a permanent-hash usage tier — see the updated body). This issue now tracks only the §9b.9 toggle-cycle anchor resets. Original body is in the edit history.