feat(cli): roll circuit-breaker state over across config wipes

[vanceingalls]

Stacked on #2854.

What

The DE parallel-router circuit breaker's tripped state lived in the same config file as the install id, so the most common identity reset — deleting ~/.hyperframes — also re-enrolled the machine into an experimental path that had already failed on it.

This mirrors exactly two facts into a machine-local state file (~/.local/state/hyperframes/install-state.json) that a config wipe does not touch:

• deParallelRouterTrialFired — a breaker tripped by a previous install stays tripped for the new one. Config corruption takes the same mint path, so it survives that too.
• markerAt — written unconditionally on every install, so the fraction of fresh mints that find it directly measures recoverable id churn (config wiped, machine persisted) vs unrecoverable (fresh machine / container / new user). Emitted as install_predecessor_found on telemetry events; absent (not false) on configs predating the field, mirroring the canary absent-vs-control semantics.

What it deliberately is NOT

The file holds no identity — no anonymousId, no counters, nothing linking old install to new. A wiped config still gets a fresh id unconditionally; only the safety fact about the machine survives. Full attribution rollover (aliasing old id to new) was considered and deferred: it collides with deliberate identity resets, and the breaker-only version captures the safety value without the intent problem. The install_predecessor_found rate is the data that would justify going further.

Mechanics

• Sync happens inside writeConfig, so no breaker write site can forget it; memoized per process so it's not an fs hit on every write.
• Atomic tmp+rename, same rationale as the config write: a torn read must never exist since a corrupted state file reads as absent.
• Failures swallowed (telemetry must never break the CLI) but leave the memo unset so a later write retries.
• hyperframes telemetry lists the state path for transparency.

Validation

18 config tests (10 new): wipe survival, corruption survival, untripped-breaker-not-invented, no-identity assertion (file keys are exactly [deParallelRouterTrialFired, markerAt], anonymousId never appears in the bytes), marker timestamp written once, state-write failure never breaks the config write, absent-vs-false on legacy configs. Full CLI suite: 2204 passed.

🤖 Generated with Claude Code