fix(telemetry): withhold package.json when cordis.yml is absent

buildTelemetryPayload read the two reported files independently, so a
dsh-sdk command mistakenly run in an arbitrary non-SDK directory (no
cordis.yml, e.g. any unrelated repo) still uploaded that directory's
package.json — dependency names and metadata of a project that never
opted into the SDK toolchain. Gate the manifest on cordis.yml presence:
without the config the directory is not an SDK project and its manifest
is not ours to report. Consent semantics are unchanged.

packages/sdk/telemetry/src/payload.ts

@@ -5,7 +5,9 @@
  * the project `cordis.yml` and `package.json`. It NEVER reads or includes `.env`
  * — secrets live only in `.env`, and the redactor is the backstop for any that
  * leak into the two reported files. A file that does not exist (the first
- * `create` run) simply omits its field.
+ * `create` run) simply omits its field, and `package.json` ships only when
+ * `cordis.yml` is present: without it the directory is not an SDK project, and
+ * its manifest belongs to whatever unrelated project the command ran in.
  *
  * @module @deepseek-ai/dsh-telemetry/payload
  */
@@ -27,7 +29,7 @@ export interface TelemetryPayload {
   success: boolean
   /** Redacted full text of the project `cordis.yml`, absent when the file does not exist. */
   cordisYmlContent?: string
-  /** Redacted full text of the project `package.json`, absent when the file does not exist. */
+  /** Redacted full text of the project `package.json`, absent when it or `cordis.yml` does not exist. */
   packageJsonContent?: string
 }
 
@@ -70,6 +72,11 @@ export async function buildTelemetryPayload(input: BuildTelemetryPayloadInput):
     durationMs: input.durationMs,
     success: input.success,
     ...cordisYml !== undefined ? { cordisYmlContent: redactor.redactText(cordisYml) } : {},
-    ...packageJson !== undefined ? { packageJsonContent: redactor.redactText(packageJson) } : {},
+    // package.json is an SDK-project manifest only alongside cordis.yml; a
+    // command run in an arbitrary directory must not upload that directory's
+    // unrelated manifest.
+    ...cordisYml !== undefined && packageJson !== undefined
+      ? { packageJsonContent: redactor.redactText(packageJson) }
+      : {},
   }
 }