fix(mastra): turn Mastra's PostHog telemetry off by default

[christian-at-sevenlab]

What this changes

Scaffolded apps no longer send Mastra usage telemetry to PostHog by default. server/mastra/index.ts sets MASTRA_TELEMETRY_DISABLED ??= 'true' before new Mastra(), and the mastra:studio task passes the same default to the Mastra CLI.

Why

@mastra/core sends feature-usage events (hashed hostname, OS, Node and Mastra versions, which features are used) to us.posthog.com from every Mastra instance unless MASTRA_TELEMETRY_DISABLED is set to 1/true/yes. The mastra CLI does the same for Studio. Nothing in the scaffold set it, so every deployed app reported to a US third party that no project declares as a processor. Keur flagged it on a client app as SCH-LEG-003 (PostHog reachable via posthog-node, undeclared).

Putting the default in server/mastra/index.ts covers every path through one line: Nitro, Studio's bundle and the production image. ??= keeps an explicit MASTRA_TELEMETRY_DISABLED=false working for a project that wants to opt in.

Type of change

• Bug fix
• New feature or template
• Refactor with no behaviour change
• Documentation
• Build, CI or release tooling

AI assistance

• No AI agent involved
• Claude Code
• Cursor
• GitHub Copilot
• Codex
• Other, named below

Agent, service and model, if you know it: Claude Code, Opus 5.5

How much of this is agent-written?

• Whole change, reviewed by me before opening
• Substantial parts, with my own edits on top
• Small parts, or just the tests or docs
• Only the commit message or this description

Feature versions

• I changed what a feature emits, and bumped that feature's version (nuxt4:mastra 2.1.1 → 2.1.2)
• I changed a collectDocs or collectEnv contribution, and also bumped the feature that writes the target file
• Not applicable

Testing

pnpm tsc                 # passes
pnpm bump:check origin/main   # OK: every changed feature carries a version bump
pnpm test                # 990 passed, 1 failed: core/test/browser.test.ts "uses xdg-open on plain Linux", which fails identically on main under WSL

• pnpm tsc passes
• pnpm test passes (except the WSL-only browser test above, unrelated)
• I removed the behaviour each new assertion covers, watched the test fail, and put it back

Not scaffolded end to end. The same setting (as an image ENV) runs in a client app built from this stack.

Checklist

• Scoped to one concern
• Public-facing docs updated where behaviour changed (see below)
• No internal tracker numbers, post-mortem narrative, or internal infrastructure details in the diff
• Files under packages/*/templates/** are LF
• No secrets, tokens or real credentials

Anything else

• Existing projects whose server/mastra/index.ts was customised (most of them, since agents get registered there) will get a .battlestack.patch on pull rather than a clean update. Until that is merged by hand, MASTRA_TELEMETRY_DISABLED=true in the deploy environment does the same job.
• I did not add a line to the generated AGENTS.md (collectDocs), which would also need a nuxt4:docs bump. Happy to add it if you want the opt-in documented there.
• posthog-node stays in the dependency tree as a transitive dep of @mastra/core; only the network traffic stops.