PostHog error tracking + source maps for loopover-ui (swap the browser-sentry.ts seam)

[JSONbored]

Part of epic #8286 (Phase 1 — Errors).

Strategy correction (2026-07-25): this is a full replacement, not a parallel-run. Every completed
sibling (self-host #8287, hosted Worker #8288, discovery-index #8289, review-enrichment #8290) deleted its
Sentry module and Sentry release workflow outright in the same PR — no bake period, no side-by-side
capture window. Treat any earlier "keep Sentry running alongside" language in this repo as stale; it predates
that correction.

Current state

apps/loopover-ui/src/lib/browser-sentry.ts (#1737): opt-in browser error tracking — complete no-op unless
VITE_SENTRY_DSN is set, @sentry/react dynamically imported inside the DSN gate so a DSN-less build never
even fetches the chunk. Deep scrub pipeline (SECRET_KEY/SECRET_VALUE incl. gts_/orbenr_/orbsec_ token
shapes, PUBLIC_LOCAL_PATH_SCRUB_PATTERN). Source maps: .github/workflows/ui-sentry-release.yml +
SENTRY_BUILD_SOURCEMAPS=1 in vite.config.ts (hidden sourcemaps only on the dedicated release workflow).

Deliverables

• Swap to posthog-js exception capture behind the same gate shape: no-op without VITE_POSTHOG_KEY,
  dynamic import inside the gate (no chunk for unconfigured builds), scrub pipeline ported to a before-send
  equivalent.
• Delete browser-sentry.ts, @sentry/react, VITE_SENTRY_DSN, SENTRY_BUILD_SOURCEMAPS, and
  .github/workflows/ui-sentry-release.yml outright in this PR — replace with a PostHog release/sourcemap
  workflow that mirrors .github/workflows/release-selfhost.yml's now-corrected pattern (see the two gotchas
  below, both found and fixed there tonight — reproduce the fix, don't reintroduce the bug):
  1. posthog-cli sourcemap inject/sourcemap upload need BOTH --release-name and --release-version
     passed explicitly. A single combined --release-version "loopover-ui@1.2.3" string is NOT enough —
     --release-name left unset makes the CLI auto-derive its own name from git/package.json and silently
     double the stored release id ("<auto-derived>@loopover-ui@1.2.3"), which then never matches anything
     that looks the release up by its expected id. Split whatever release-string convention you land on at
     its first @ into separate --release-name/--release-version flags (see
     .github/workflows/release-selfhost.yml's "Upload PostHog source maps" step).
  2. PostHog's error_tracking/symbol_sets API returns release as a nested {project, version, ...}
     object, never a flat string. If this issue's release-validation step reuses
     review-enrichment/scripts/validate-posthog-release.mjs (recommended — it's the real, tested, working
     implementation as of tonight) this is already handled by its releaseIdentifier() helper. If you write
     anything new that inspects a symbol set's release field, reconstruct "{project}@{version}" from the
     object — do not compare it as a string directly, that comparison can never match.
• Bundle impact measured against the existing UI bundle-size CI gate (posthog-js is heavier than the
  error-only Sentry surface — if it breaks the budget, capture-only config or lazy strategy, documented).
• Coordinate init with the web-analytics sub-issue (PostHog web analytics behind the first-party /stats proxy (Umami replacement, parallel-run) #8293): ONE posthog-js instance serves analytics +
  errors + (later) replay — whichever sub-issue lands first owns the init module, the other extends it.
• Tests: mirror browser-sentry.test.ts's redaction/gating coverage, plus a release-validation test
  suite mirroring review-enrichment/test/posthog-release-validation.test.ts (its fixtures use the REAL
  nested-object release shape — copy that pattern, don't reintroduce flat-string test fixtures that would
  hide the exact bug found tonight).

Boundaries

• No web analytics or replay here (own sub-issues); shared-init coordination only.

Resources

• .github/workflows/release-selfhost.yml (self-host's release/sourcemap workflow — the corrected reference
  implementation, fixed across PRs fix(selfhost): read POSTHOG_CLI_PROJECT_ID/HOST from secrets, not vars #8621/fix(selfhost): unset POSTHOG_CLI_HOST when blank, don't pass empty #8622/fix(posthog): pass release-name and release-version as separate CLI flags #8624/fix(posthog): compare symbol-set release as a nested object, not a string #8629 tonight)
• review-enrichment/scripts/validate-posthog-release.mjs + review-enrichment/test/posthog-release-validation.test.ts
  (the working, tested release-validation implementation to reuse or mirror)
• https://posthog.com/docs/error-tracking/upload-source-maps

[linear-code]

JSO-5734