feat(eslint+ci): R40 boundary rule for @sentry/* + R31 sendDefaultPii grep gate

Adds two flat-config blocks to core-eslint/base.js: (1) repo-wide
no-restricted-imports for @sentry/* with the R40 message, (2) an
allowlist override for the only paths permitted to import the Sentry
SDK directly — core-shared/instrumentation/sentry/**, the bind-sentry
DI files, the no-sentry test guards, and apps' instrumentation* /
next.config / vite.config / sentry.*.config files. Patterns use
**/-prefix so they match whether ESLint runs from the repo root or
from inside a sub-package.

Also adds the standard `argsIgnorePattern: "^_"` config (used
throughout the repo) and a Node-globals override for *.mjs/*.cjs/*.js
and *.config.{ts,tsx} so withSentryConfig in next.config.mjs lints
clean. Required adding `globals` as a core-eslint dep.

Adds .github/workflows/sentry-pii-guard.yml — a lightweight CI step
that fails any PR introducing `sendDefaultPii: true` (R31). Excludes
node_modules / dist / .next / .turbo from the grep so vendored SDK
JSDoc examples don't false-positive.

Pre-existing lint nits cleared as part of getting `pnpm lint` green:
- core-testing define-contract-suite.test.ts: void the unused
  receivedTracer (mirrors the next test's pattern)
- marketing-pages bind-dev-seed.ts: drop unused MockSiteSettingsRepository
  import
- marketing-pages get-site-settings.use-case.ts: drop the now-redundant
  eslint-disable for `_input`

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/marketing-pages/src/application/use-cases/get-site-settings.use-case.ts

@@ -16,7 +16,6 @@ export type IGetSiteSettingsUseCase = ReturnType<typeof getSiteSettingsUseCase>;
 
 export const getSiteSettingsUseCase =
   (siteSettingsRepository: ISiteSettingsRepository) =>
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
   async (_input: GetSiteSettingsInput): Promise<GetSiteSettingsOutput> => {
     const result = await siteSettingsRepository.getSiteSettings();
     return getSiteSettingsOutputSchema.parse(result);

packages/marketing-pages/src/di/bind-dev-seed.ts

@@ -7,7 +7,6 @@ import {
 import { marketingPagesContainer } from "./container.js";
 import { MARKETING_PAGES_SYMBOLS } from "./symbols.js";
 import { MockPagesRepository } from "../infrastructure/repositories/pages.repository.mock.js";
-import { MockSiteSettingsRepository } from "../infrastructure/repositories/site-settings.repository.mock.js";
 import { buildDevPages, buildDevSiteSettings } from "../__seeds__/dev.js";
 import { getSiteSettingsUseCase } from "../application/use-cases/get-site-settings.use-case.js";
 import { getPageBySlugUseCase } from "../application/use-cases/get-page-by-slug.use-case.js";