[FEATURE]: Default sharing to "disabled" — privacy by default #17188

Feature hasn't been suggested before.

• I have verified this feature I'm about to request hasn't been suggested before.

Related: #7982, #459

Describe the enhancement you want to request

Default sharing behavior raises privacy and informed consent concerns

The current default ("share": "manual") allows any user to upload their full session — including file contents, terminal output, and environment context — to external servers (opncd.ai) with a single /share command, without any confirmation dialog or informed consent step.

While /unshare does delete session data from the remote server, several concerns remain:

1. Informed consent: Users are not warned before upload about what data is being shared, where it is stored, for how long, and who has access. This conflicts with fundamental data protection principles (GDPR Art. 5 — transparency, CCPA, and most privacy frameworks).

2. Incidental data exposure: Coding sessions routinely capture sensitive data — .env files, credentials, personal information in test data, proprietary algorithms. Users may not realize that a shared session includes all of this context, not just their prompt.

3. No confirmation before upload: There is no consent dialog before /share executes. A single accidental invocation exfiltrates the entire session. Privacy-respecting UX requires explicit confirmation for irreversible data transfers.

4. No data retention policy: Sessions shared to opncd.ai are stored indefinitely on Cloudflare infrastructure (R2 + Durable Objects) with no automatic expiration. There is no privacy policy (opncd.ai/privacy → 404), no terms of service (opncd.ai/terms → 404), and no documentation on who can access stored sessions or whether they are used for any secondary purpose. The only written statement is a single line in the docs: "data persists until you unshare."

5. Privacy by default: The principle of privacy by default (GDPR Art. 25) requires that the most privacy-protective configuration applies without manual action. Sharing should be opt-in ("disabled" by default), not opt-out.

Recommendations (ordered by implementation effort):

1. Change the default to "disabled" — one-line change, immediate impact, aligns with privacy-by-default
2. Add a confirmation dialog to /share — display what will be uploaded and to which endpoint before proceeding
3. Publish a privacy policy and terms of service for opncd.ai — document data retention, access controls, jurisdiction, and secondary use
4. Add automatic expiration — shared sessions should have a configurable TTL with a reasonable default (e.g. 30 days)

The "share": "disabled" config workaround exists today, but defaults matter — most users never change configuration files, and organizations cannot rely on per-user configuration for data protection compliance.