feat(cms): Sentry server instrumentation + withSentryConfig + R38 PII test

Adds apps/cms/instrumentation.ts (server-only — Payload admin client DSN
is out-of-scope per spec §8). Wraps the Payload-wrapped next config with
withSentryConfig. Adds the R38 PII scrubber test. Required adding
@repo/core-shared as a direct dep of cms (was only transitive before).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/cms/instrumentation.ts

@@ -0,0 +1,20 @@
+// apps/cms/instrumentation.ts
+// CMS is server-only (Payload admin UI). No instrumentation-client.ts here —
+// Payload admin UI bundling is opinionated and the public DSN flow is
+// out-of-scope per spec §8.
+
+export async function register() {
+  if (
+    process.env["NEXT_RUNTIME"] === "nodejs" ||
+    process.env["NEXT_RUNTIME"] === "edge"
+  ) {
+    const { initSentryServer } = await import(
+      "@repo/core-shared/instrumentation/sentry/init-server"
+    );
+    initSentryServer({
+      dsn: process.env["CMS_SENTRY_DSN"],
+      app: "cms",
+      release: process.env["VERCEL_GIT_COMMIT_SHA"],
+    });
+  }
+}