privacy: name the IP address and describe the TestFlight build as it ships (FRE-1480)

CTO verdict at FRE-1480: two sentences at db3e695 were false.

(b) sendDefaultPii = false does not stop Sentry receiving the connection
IP (sentry-cocoa 9.26.1 sets infer_ip = auto for Cocoa; only the Sentry
project's Prevent Storing of IP Addresses switch stops it) — the shipped
Settings rows already say so. The IP sentence is restored.

The iPhone paragraph described an opt-in build no tester has: the build
in TestFlight (ios-v0.3.2, 2026-10-22) predates FRE-355 and starts
Sentry on every launch with no off switch. The paragraph now says that.

Header comment and marketing/drafts/privacy-page.md rows corrected to
match (release range narrowed to 0.3.0-0.15.0; evidence rows record the
IP and the TestFlight provenance). privacy-page.patch regenerated.

Suite: merge tree of a0e6ff1 + this branch runs the same failure set as
clean a0e6ff1 (2 junit failures, the known Lineage-redirect
environmental pair); the host's env-validation aborts account for the
count noise. Zero new failures.

src/routes/nook/privacy.tsx

@@ -11,17 +11,22 @@
  * releases v0.15.1 and later — FRE-355 (merge `6e74b261`) first shipped in
  * `v0.15.1` (2026-11-04), and the live appcast serves `v0.15.2`. When enabled,
  * Sentry receives crash and error reports, session pings, and performance
- * traces at a 0.1 sample rate (`tracesSampleRate = 0.1`), and no IP address is
- * attached (`sendDefaultPii = false`, `Sources/NookApp/main.swift` and
- * `Sources/NookCore/System/CrashReporting.swift`). Builds before `v0.15.1`
- * started Sentry on every launch with `sendDefaultPii = true` and no off
- * switch; this page describes the current release.
+ * traces at a 0.1 sample rate (`tracesSampleRate = 0.1`), and it also receives
+ * the connection's IP address (`sendDefaultPii = false` is the SDK default and
+ * does not suppress it — sentry-cocoa 9.26.1 sets `infer_ip = auto` for Cocoa,
+ * and only the Sentry project's *Prevent Storing of IP Addresses* switch stops
+ * that; FRE-1480). Releases 0.3.0 through 0.15.0 started Sentry on every
+ * launch with `sendDefaultPii = true` and no off switch; this page describes
+ * the current release. The iPhone paragraph describes `ios-v0.3.2`
+ * (2026-10-22, the build in TestFlight) until an `ios-v*` tag carries
+ * FRE-355's opt-in code.
  *
  * The *Contingency* in `marketing/drafts/privacy-page.md` fired with `v0.15.1`
  * and is applied in this commit, with two corrections against the pre-written
  * swap text: the shipped build still sends session pings and traces while
  * enabled, so they are named (the contingency's own completeness warning), and
- * `sendDefaultPii = false` means the IP sentence is dropped rather than kept.
+ * the IP sentence is kept — the pre-written swap text already had it, and
+ * `sendDefaultPii = false` does not stop Sentry receiving the IP (FRE-1480).
  *
  * Corrected against the CTO's /privacy verdict (FRE-354): no macOS username
  * from Sentry (sendDefaultPii sets the IP only), session pings named, (a)
@@ -86,9 +91,8 @@ export default function NookPrivacyPolicy() {
                 and a sample of performance traces to Sentry, our
                 crash-reporting processor. Each report carries the app version,
                 the macOS version, the Mac model and what the app was doing
-                when it failed. Your IP address is not attached to the reports.
-                They never include your prompts, your code or your session
-                content.
+                when it failed. Sentry also receives your IP address. They
+                never include your prompts, your code or your session content.
               </div>
               <div class="pb-2">
                 <div class="-ml-6">(c) Phone connection:</div> The phone
@@ -169,13 +173,12 @@ export default function NookPrivacyPolicy() {
               </div>
               <div class="pb-2">
                 <div class="-ml-6">The iPhone companion.</div> The iPhone and
-                Apple Watch app is in TestFlight beta. Its crash reporting is
-                the same opt-in: off unless you turn it on in its settings.
-                When it is on, it sends crash reports, session pings and a
-                sample of performance traces to Sentry — the app version, the
-                iOS version and the iPhone model, with no IP address attached.
-                Those reports never include your prompts, code or session
-                content.
+                Apple Watch app is in TestFlight beta. The build in TestFlight
+                starts Sentry on every launch, with no setting that turns it
+                off: it sends crash, error and hang reports, session pings,
+                performance traces, the app version, the iOS version, the
+                iPhone model and your IP address. Those reports never include
+                your prompts, code or session content.
                 Its other network traffic is the phone connection in (c) — the
                 relay, or a direct LAN/tailnet link — plus, if you allow
                 notifications, the push token it gives the relay so Apple can