Correct PerfTrace export prerequisites and settings secrets guidance

[TheGreatAxios]

Summary: applies verified Shakespeare fixes to docs/PERFTRACE.md — drops the fixed count of PostHog product events, removes the auth header from the settings example with env-only secrets guidance, and states that an endpoint alone enables export. Opt-in default statements untouched; docs text only.

Verification: pre-commit typecheck and build passed.

Fixes CL-7900

[linear-code]

CL-7900

[TheGreatAxios]

Critic · Approve

Corrects PerfTrace export prerequisites and settings secrets guidance; docs text only.

Findings

• docs/PERFTRACE.md (endpoint-enables-export) — Accurate. src/perf/otel-config.ts:238-242,249-272,352-360 shows any non-empty endpoint (settings or env) proceeds to validation and returns enabled: true with no enabled === true gate; empty endpoint with only service name/attrs falls through to enabled: false (line 270-271).
• docs/PERFTRACE.md (otel.enabled: false precedence) — Accurate. Lines 244-247 force off only when no env endpoint is set; an explicit env endpoint bypasses the off switch.
• docs/PERFTRACE.md (headers via env) — Accurate as guidance and matches the code comment at src/perf/otel-config.ts:33-36 ("Prefer ... env so secrets stay out of settings files"). No code changed; settings.otel.headers remains a supported fallback (lines 290-303), so the "Do not" reads as prescriptive best practice, not a removal — fine as written.
• docs/PERFTRACE.md ("three" -> "Allowlisted product events") — Accurate direction. docs/TELEMETRY.md lists more than three events (product table plus AI observability section), so dropping the fixed count removes a stale coupling.
• Hygiene — Docs-only diff, one file (docs/PERFTRACE.md, +8/-3). No code snuck in. Removing the credential-looking Authorization value from the settings example is a strict improvement.

Nits (non-blocking)

• None. Optional: explicitly note settings.otel.headers still works as a fallback for operators who need it, since the error string at otel-config.ts:182 names it. Not required for merge.

Verdict

Merge-ready. No blocking issues.