feat(omo-codex): wire Codex SessionStart telemetry for DAU/WAU/MAU

Adds a new Codex plugin component `telemetry` that emits a single
omo_codex_daily_active event (reason: session_start) from every Codex
SessionStart hook, with the same UTC-day deduplication, hashed
installation identifier, and four-flag opt-out as the install-time
event. Previously omo-codex telemetry only fired on install_completed,
so DAU/WAU/MAU under-reported real Codex usage.

- New plugin component packages/omo-codex/plugin/components/telemetry/
  mirrors the rules/comment-checker/lsp pattern: own src/, tsc build,
  vitest tests, package.json (posthog-node dep), hooks/hooks.json.
- src/codex-hook.ts wraps createPluginPostHog().trackActive(..., "session_start")
  with safeShutdown so Codex session startup never blocks on telemetry.
- Plugin root hooks.json + workspaces register the new component
  alongside rules and ultrawork on SessionStart.
- Aggregate test expectations updated to include the telemetry directory.
- cross-package-equivalence.test.ts pins product-identity constants and
  shouldDisablePostHog behavior to stay byte-equivalent between the CLI
  installer (src/telemetry/) and the plugin runtime
  (plugin/components/telemetry/src/), so the two PostHog sources never
  drift on event name, distinct_id base, dedup file path, or opt-out
  flags.
- PostHogActivityReason union in the CLI-side posthog.ts gains
  "session_start" so future CLI paths can emit the same reason without
  a type break.

packages/omo-codex/plugin/components/telemetry/src/atomic-write.ts

@@ -0,0 +1,21 @@
+import { renameSync, unlinkSync, writeFileSync } from "node:fs";
+
+export function writeFileAtomically(filePath: string, content: string): void {
+	const tempPath = `${filePath}.tmp`;
+	writeFileSync(tempPath, content, "utf-8");
+
+	try {
+		renameSync(tempPath, filePath);
+	} catch (error) {
+		const isPermissionError =
+			error instanceof Error && (error.message.includes("EPERM") || error.message.includes("EACCES"));
+
+		if (process.platform === "win32" && isPermissionError) {
+			unlinkSync(filePath);
+			renameSync(tempPath, filePath);
+			return;
+		}
+
+		throw error;
+	}
+}