Bring live Sentry mode back to Glitch Invaders through vault_services #25

Need

Glitch Invaders (#23) shipped demo-only: the Incident Console shows simulated Sentry evidence. Live mode was removed because the package read a token from GLITCH_* variables or a live.config.json, which no station provides. boothstrap.sh now delivers any service a challenge names in vault_services (MLH/boothstrap.sh#519, merged as MLH/boothstrap.sh#528): the event vault defines the service and the credential name it injects, the station sets that variable to a placeholder in the package's hooks and servers, and the vault proxy swaps in the real token on the way out. The requirement is set by the challenge, not by boothstrap, so the package can now declare what it needs and get it.

Design

• Declare: vault_services becomes ["gemini", "sentry"]. The sentry service's credential is SENTRY_AUTH_TOKEN (bearer, upstream sentry.io), the name Sentry's own tools read.
• Token stays server-side. The page server reads SENTRY_AUTH_TOKEN from its environment (the setup hook already inherits it) and calls the Sentry API through the station's proxy with the placeholder value; the vault injects the real token. The page never sees the variable, and the server never logs it.
• Public values live in the package. The DSN, org slug, and project slug are not secrets; a DSN is what every frontend ships. Put them in one file in the package (for example challenges/glitch-invaders/sentry.json), with placeholder values until MLH creates the project. Loading the file with placeholders, or no file, means demo mode.
• Live mode is on only when both halves are present: SENTRY_AUTH_TOKEN is set and the package's Sentry config holds real values. Otherwise the game runs exactly as today (demo), with the same Incident Console, markers, and done_when lines. npm run verify, npm test, and boothstrap dev without a token keep working unchanged.
• Where live evidence comes from: restore the live path from the branch's first commit (51bd37a on feat/glitch-invaders, before 14b305d removed it), adapted to this design: the page reports the three intentional failures to the DSN, the server fetches the matching issue, breadcrumbs, and trace from the Sentry API, and the Incident Console renders them in place of the simulated evidence. Keep the CSP: add only the DSN's ingest origin to connect-src, and vendor any SDK code into the package rather than loading it from a CDN (script-src 'self').
• Compatibility: the station needs a boothstrap that includes MLH/boothstrap.sh#528. 0.1.0 (latest) predates it; the daily next prerelease after 2026-10-18 09:23 UTC and the next release include it. On an older station the challenge gets no token and runs demo; with sentry in vault_services, the event vault must hold a sentry service or the station lists the challenge as unavailable, on every version. Say so in the package README, including what the event vault needs (sentry, bearer, SENTRY_AUTH_TOKEN, sentry.io). Do not bump the root @mlhacks/boothstrap pin in this PR.

Done when

• challenge.json names gemini and sentry; the package's Sentry config file exists with placeholders and a comment on where the values come from.
• With no token or placeholder config, behaviour is byte-for-byte today's demo mode; npm run verify, npm test, npm run lint pass with no network and no credentials.
• With a token and real config, the server calls the Sentry API through the proxy and the console shows live evidence; covered by tests against a local stand-in for the Sentry API (see docs/style/testing.md's network rule), including: the token never appears in any response, page asset, or log; a Sentry outage falls back to the simulated evidence for that incident with a visible note rather than a blank console.
• Standalone Pi flow in skills/start-challenge/SKILL.md still works.
• Package README and intro.md updated; root README index entry still accurate.

Out of scope

Creating the MLH Sentry project and filling in the real DSN and slugs (human step; flag it in the PR's Decide section). Bumping the boothstrap pin.