feat: collect crash reports from CLI errors and panics

[thejoeejoee]

Problem

jailoc has no visibility into CLI crashes or errors in the wild. When users hit failures (Docker errors, config validation, panics), there's no telemetry to understand failure patterns.

Proposal

Integrate sentry-go SDK for crash reporting, enabled by default (opt-out via DO_NOT_TRACK=1).

Integration point

Single capture boundary in cmd/jailoc/main.go around cmd.Execute():

• Error capture: all RunE errors from every subcommand bubble up through Execute() — capture there before os.Exit(1)
• Panic recovery: no recover() exists today — add sentry.Recover() as deferred call
• Flush: HTTPSyncTransport (blocking) since CLI is short-lived; double flush (defer + before os.Exit) because defers don't run on os.Exit

Key decisions

• Opt-out via DO_NOT_TRACK=1 — follows Console Do Not Track convention
• DSN hardcoded in source — works with all install methods (go install, GoReleaser, manual build); DSN is a public ingest key, not a secret
• HTTPSyncTransport — async transport risks losing events before CLI exits
• Release from existing -ldflags version — reuse version already embedded at build time
• AttachStacktrace: true — useful for CLI error context

New dependency

github.com/getsentry/sentry-go

Scope

• cmd/jailoc/main.go — init, capture, flush, hardcoded DSN
• Docs — mention telemetry and DO_NOT_TRACK=1 opt-out