Keep PostHog executable code in the pinned bundle

[parsakhaz]

Pane's default PostHog entry downloaded executable config.js and could lazy-load extensions outside the reviewed lockfile graph. This bypassed the supply chain guarantees of the packaged application.

This PR uses the installed SDK's supported module.no-external entry and enables disable_external_dependency_loading. Remote configuration remains JSON data; analytics capture, identity, attribution, consent defaults, and explicit opt-out retain their existing behavior. No dependencies or lockfiles change.

The maintained analytics browser journey now verifies actual SDK identity and interaction payloads, alongside the existing first-open and opt-out markers. It advertises remote replay, surveys, and exception features and rejects every external script request. The opt-out test waits for Privacy Settings and rejects each forbidden event individually, replacing its weak 250 ms timing check. Both cases are included in CI.

Validation:

• pnpm lint and pnpm typecheck with repository-pinned pnpm 10.19.

• Frontend production build, including xterm and React Scan build guards.

• Analytics browser journeys against Vite dev and production preview: 2/2 passing in each.

• Negative control: restoring the original loading behavior fails the same network assertion on config.js, lazy-recorder.js, surveys.js, and exception-autocapture.js.

Closes #640

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T15:27:09.664405Z	fc22573	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 819b9f6.}