privacy: P0-3 + P1-1 — consent banner + per-install anonymous_id

P0-3 — consent banner
=====================
Before the FIRST telemetry_event call (which is `install_start`,
fired right after the SMART INSTALL banner), the script now prints:

  📊 Telemetry: install + version events go to telemetry.uaml.ai.
     What's collected:  event name, UAML version, OS major.minor,
                         Python version, CPU arch, random per-install ID.
     What's NOT sent:   hostname, IP, email, file paths, DB content.
     Opt-out now:       Ctrl-C, then: UAML_TELEMETRY=0 curl install.uaml.ai | bash
     Full details:      https://install.uaml.ai/privacy.html

Two-second sleep when stdin is a TTY (interactive user gets a moment
to read + Ctrl-C), no sleep in non-TTY (curl | bash) so the user
experience for piped install isn't artificially slow.

Banner is suppressed when UAML_TELEMETRY=0 is already set — no point
showing a consent screen for something that will never fire.

The install.sh argv parser already had `--no-telemetry` (line 49) which
exports UAML_TELEMETRY=0 before the banner runs, so that flag also
suppresses the banner.

P1-1 — bash-side anonymous_id matches the new uaml/telemetry.py contract
========================================================================
Mirror the per-install random hex generation: read the cached value
from $UAML_CONFIG_DIR/telemetry.json (defaults ~/.uaml/telemetry.json)
if present; otherwise generate via `secrets.token_hex(8)` (or
/dev/urandom + xxd as a no-Python fallback) and persist it. Same file,
same field, same shape as the Python module — so install_start sent
from bash and install_ok sent from python see the same anonymous_id
for the same machine.

Final fallback when neither python3 nor /dev/urandom yields anything
useful: legacy sha256(hostname). Never returns empty.

Verified: consent banner shows under default; suppressed when
UAML_TELEMETRY=0 is exported; install.sh syntax check passes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
