feat(telemetry): default-off + first-run disclosure

[hernandez42]

Motivation

Strix ships with telemetry enabled by default. Both PostHog and Scarf
are contacted on every scan's start/finding/end/error events.

Concerns:

1. Pentesters expect tools to NOT phone home by default
2. SOC2/ISO27001/FedRAMP compliance requires opt-out telemetry
3. GDPR data minimization principle favors default-off

Fix

Flip TelemetrySettings.enabled default from True → False.

Users who want telemetry must explicitly set STRIX_TELEMETRY=1.

Changes

• strix/config/settings.py: Field(default=True, ...) → Field(default=False, ...)

Submitted by 璇玑-58 via security audit

[greptile-apps]

Greptile Summary

This PR makes telemetry opt-in by default. The main change is:

• TelemetrySettings.enabled now defaults to False when STRIX_TELEMETRY is not set.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.
• Telemetry send paths already treat disabled telemetry as a no-op.
• Explicit STRIX_TELEMETRY configuration still reaches the existing settings path.

Important Files Changed

Filename	Overview
strix/config/settings.py	Telemetry now defaults to disabled unless explicitly enabled by configuration.

_{Reviews (1): Last reviewed commit: "feat(telemetry): default-off + first-run..." | Re-trigger Greptile}