fix(audience): atomic ConsentState for Full→Anonymous userId race (SDK-233)

[ImmutableJeffrey]

Summary

• Introduces ConsentState — an immutable record packing (ConsentLevel, UserId). _state is a volatile ConsentState, so a single reference swap publishes both fields atomically and readers never observe (Anonymous, oldUserId).
• Takes _initLock in Identify, Reset, and SetConsent around the state swap so the pair stays atomic against concurrent callers.
• Changes EnqueueChecked signature: replaces Func<bool>? stillAllowed with Func<Dictionary<string, object>, Dictionary<string, object>?>? transform. The transform runs under _drainLock and returns the (possibly mutated) msg, or null to drop.
• Re-reads _state inside _drainLock at enqueue time: EnqueueTrack strips userId when the current level is not Full; EnqueueIdentity drops when the current level is not Full. Closes the race where a Track racing SetConsent(Full → Anonymous) could land an old-userId msg on disk after ApplyAnonymousDowngrade had already rewritten the queue.
• Adds a 200-iteration × 4-thread stress test: concurrent Tracks racing SetConsent(Full → Anonymous) after Identify, asserting zero userId leaks on disk.
• Polyfills IsExternalInit — record { init; } requires it and netstandard2.1 (Unity) does not ship it.

Linear:

• SDK-233 — primary
• SDK-143 — contributes thread-safety: atomic ConsentState makes SetConsent callable from any thread

---

Note

Medium Risk
Touches consent/identity handling and concurrency around event queuing, where mistakes could cause userId leakage or dropped events. Changes are localized and backed by new stress coverage, but affect a privacy-sensitive path.

Overview
Prevents privacy-related race conditions by replacing separate volatile _consent/_userId fields with a single volatile ConsentState record and updating Identify, Reset, Shutdown, ResetState, and SetConsent to swap this state under _initLock.

Hardens queuing against concurrent consent changes by changing EventQueue.EnqueueChecked to accept an under-_drainLock transform (mutate/drop message), and routing Track/Identify/Alias through new EnqueueTrack/EnqueueIdentity helpers that re-read current consent to drop events under None and strip userId when not Full. Adds a stress test covering the Full→Anonymous race and a Unity IsExternalInit polyfill to support the new record type.

^{Reviewed by Cursor Bugbot for commit a1ee630. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 08cfe25. Configure here.}