[codex] Wire Sentry release metadata

[rgilks]

Summary

Adds the Sentry build-time environment expected by the existing dormant browser instrumentation:

• passes the browser DSN, production environment, and GitHub SHA release into the static build
• sets sendDefaultPii: false
• records the release in the Sentry client init
• keeps tracing disabled for this static client-side app

Validation

• Existing local rollout validation completed before publishing this PR
• Diff inspected and staged explicitly