Honor explicit telemetry disable in the STX head helper and raw tag

ReviewOS HQ API/browser job 7081 (run 2546, source 7e99859) passed its API suites and German language/render checks, then failed one strict console audit because https://analyticshq.org/script.js returned net::ERR_CONNECTION_REFUSED on /relax at 1280px. The CI app deliberately runs production behavior for security checks, so the production fallback App ID also emitted synthetic tracking traffic.

The first-party tracking package supports enabled: false through tsAnalyticsStxConfig, but its shared tsAnalytics head helper and tsAnalyticsTag lack the option. Add consistent explicit opt-out to the public base options and head helper. Preserve default behavior and leave strict browser request/error checks enabled. HQ will consume the normal patch release and explicitly disable its analytics only in its owned CI environment, rather than hiding a network failure or substituting responses.

Regression at the existing public helper seam: an App ID with enabled: false emits neither head entries nor a raw script tag; enabled: true still emits the tracker.

Related launch tracker: https://github.com/stacksjs/hq.training/issues/346. Retained failure is in https://reviewos.org/stacks/hq.training/run/2546, job 7081, log sequence 181.

Completed in source 666b341, normally published in @ts-analytics/tracking 0.1.19 (188618c2879c906174604fc1b50011a6b5df3ee3). Exact-source CI passed: https://github.com/stacksjs/ts-analytics/actions/runs/41396880408; normal publisher passed: https://github.com/stacksjs/ts-analytics/actions/runs/41396880217.

The head helper and raw tag now honor the same explicit enabled: false option as the STX config helper. Existing/default tracking behavior remains enabled. The focused regression fails before the change; all 772 package tests / 1,783 assertions now pass. Type checks pass; full Pickier has zero errors and existing warnings outside these files, while changed-file checks are clean. Normal library build emits all declared JS/declaration entrypoints.

HQ consumed the actual public version through a normal exact dependency update and frozen installation, in https://github.com/stacksjs/hq.training/commit/1ee547662. Actual document-head generation in production mode yields zero tracker script references with ANALYTICSHQ_ENABLED=false and exactly one with it true. HQ types and Pickier pass. Its owned CI explicitly disables telemetry without weakening console/request assertions or production security behavior; the real German browser rerun remains tracked at /stacks/hq.training/issues/388.

The initial 0.1.18 candidate was correctly held by the existing version/build guard because the project had locked an older shared Bumpx CLI. The existing shared tooling was updated to published 0.2.30, its normal command restored source/metadata consistency, and the normal 0.1.19 patch advanced both together. No public tag was moved and no gate was bypassed.