fix(cli): read the telemetry token per call so tests don't depend on the publish job's env - #7822

Summary

• The CLI publish failed in its test step: sim telemetry status has a test asserting that a build without a reporting token reports nothing, and it read the token from the ambient environment. The publish job now sets the token for the whole job, so the test saw one and failed, and nothing was published
• The token is now read when builtInIngestTarget() is called instead of at module load. The reads stay literal process.env.SIM_CLI_TELEMETRY_* expressions, so the bundler still inlines them into the published build
• The telemetry command tests pin the token and opt-out variables, so they give the same result in any shell or CI job, and a new test covers the build-with-a-destination case
• This touches packages/sim-cli, so merging it runs the publish again

Type of Change

• Bug fix

Testing

• Reproduced the CI failure locally by running the suite with the publish job's env; it passes with and without that env after the change
• Confirmed the new pinning fails against the old module-level read
• Ran the publish job's sequence locally (tests, type-check, build, pack smoke, publish dry-run with its prepublishOnly rebuild): the shipped bundle has the token inlined, no raw env reads left, and sim telemetry status reports on
• bun run lint, check:audits, and docs-manifest:check pass

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)