feat(sentry): trim native scope per privacy tier and filter native metrics

[gmaclennan]

Closes #79
Closes #191

The Android and iOS Sentry SDKs attach a lot of device detail to every event by default. This trims that to what each privacy tier promises (plan §9b.3), slims the boot transaction (§9b.4), keeps the backend's free-memory/free-disk numbers fresh on every event at the usage tier (§9b.6), and adds the forbidden-tag metric filter the JS/Node paths already have to the native countMetric paths.

On Android a new TierScopeEventProcessor (registered in SentryFgsBridge.init, which now receives the applicationUsageData flag) rebuilds the device/os/app contexts from a per-tier allowlist — diagnostic keeps manufacturer/brand/model/model id/family/arch/simulator/core count/memory size plus OS name+version and app id/version/build; the usage tier adds back kernel version, Build.DISPLAY, app name, the culture block, and screen metrics. Storage size is bucketed to standard marketed sizes (32–1024 GB) at both tiers, and comapeo.boot transactions at diagnostic lose the boot.kind tag and all span data while keeping phase spans, timings, and bare phase-name descriptions. iOS mirrors this with SentryScopeTier, wired as beforeSend/beforeSendSpan in SentryNativeBridge.initFromConfig and operating on the dictionary-shaped cocoa contexts. Rebuilding from an allowlist (rather than nulling a denylist) means fields added by future SDK versions are dropped by default.

For #191, SentryFgsBridge.countMetric and SentryNativeBridge.countMetric now run a hand-mirrored isForbiddenMetric check (SentryMetricScrub.kt / SentryMetricScrub.swift) before reaching the SDK, matching the shared list in src/sentry-scrub.ts and backend/before-send.js; all four copies now point at each other.

On the backend, a node_resources event processor (backend/lib/node-resources.js) re-reads os.freemem/os.totalmem and fs.statfsSync of the private storage dir on every capture. It is usage-tier-only (read-at-capture frequency is itself usage-shape data) and checks the live tier state per event so repeated init() in tests stays order-independent. loader.mjs now forwards the storage-dir positional to initSentry.

Tests: per-tier field assertions on both platforms (SentryScopeTierTest.kt, SentryScopeTierTests.swift), boot-transaction slimming both tiers, forbidden-metric drop vs. ordinary exit-metric pass on both platforms (including an SDK-level check on Android via the metrics beforeSend seam), and backend tests for freshness, statfs failure tolerance, and the usage-tier gating end-to-end through the envelope sink. Docs updated where they described the old fatal-only freemem behaviour.