fix(analytics): preserve attribution and relay embedded Brain events

[zjy365]

Embedded Brain activity stops following the Desktop user after module_open: child-frame events use an independent analytics context, and both entry redirects discard sea_attr and consent_token.

Preserve the two marketing parameters across / and /deploy redirects and capture them during SDK bootstrap. Queue early embedded events until Desktop reports its optional features.analytics capability, then relay custom events through the existing runEvents("trackAnalyticsEvent", payload) API. Standalone Brain and older Desktop deployments retain the existing GTM transport. Once Desktop owns delivery, acknowledgement failures do not also send through iframe GTM.

The companion Desktop change supplies the canonical UUID and attribution through the parent analytics context. Deploy Desktop first for immediate continuity; this PR can still merge independently because capability negotiation preserves the older-host behavior. No SDK package update, database migration, or GTM publication is required for the embedded flow.

Validation:

• bun check and bun typecheck from the repository root.
• 33 focused tests passed across analytics transport/events, marketing attribution/redirects, template/GitHub links, and SDK hydration (bun test from apps/ui).
• Tests cover startup buffering, one-time relay, old-host fallback, standalone delivery, lost acknowledgements, UTF-safe parameter preservation, and credential exclusion.

Companion Desktop PR: labring/sealos#7356.