Under the hood
Telemetry auth-sending logic was tightened with an endpoint allowlist check.
shouldSkipAuthForSend now short-circuits to skip auth whenever the target endpoint isn't allow-listed or first-party HTTPS, before falling into the existing trust and token checks. A new shouldAttachAuthWithoutProfileScope path also covers stored, env, and fd credential lanes.