v1.108.71 - Packaging de-risk: lazy telemetry worker + complete PyPI metadata

Phase 1 of the maintenance PRD: packaging de-risk. No tool behavior change.

Lazy telemetry worker (F-T01). The community-meter sender used to spawn a daemon thread at module import, unconditionally, even when sharing was disabled. An import-time background-service side effect is the shape automated package scanners react to, and it ran for opted-out users too. The worker now starts lazily on the first share, which is only reached behind the existing share_savings opt-out gate, so a plain import jcodemunch_mcp has no background-thread side effect and an opted-out process never spawns the thread. Thread-safe double-checked start.

Endpoint override (F-T02). JCODEMUNCH_TELEMETRY_URL redirects the meter endpoint without a code change (resolved at send time). Default unchanged.

Complete PyPI metadata (F-PK01/F-PK02). Added license = {file = "LICENSE"} (the existing dual-use license), keywords, and standard classifiers (Development Status, Intended Audience, License :: Other/Proprietary License, OS Independent, Python 3.10-3.13, Topic :: Software Development). twine check passes. Documented the all extra as a hand-maintained union.

Docs (F-D01). The README "Background behavior, fully disclosed" section now states the worker starts lazily and only when sharing is enabled, and names the endpoint override.

New tests/test_v1_108_71.py (6): a fresh-interpreter subprocess asserts import starts no worker thread; lazy-start is idempotent; an opted-out flush never reaches the worker starter; URL override and fallback. Full suite 4696 passed / 10 skipped; CI green on Windows + Ubuntu, py3.10 to 3.13.