feat(logging)!: make C5 session logging opt-in

Session logging is the one opinionated category that writes a persistent
record of terminal output to disk, and those logs can contain secrets.
Silent-by-default is the wrong posture for it, so C5 now defaults to off:
__fish_config_op_logging must be set to an explicit truthy value to enable
capture, and the master switch cannot enable it on its own.

Implemented as a single special case in __fish_config_op_enabled, so all
five capture components, the sentinel file, the paru/yay wrappers, the
Kitty watcher, and the config-settings TUI pick it up with no other code
changes. The existing startup sync in conf.d/logging-events.fish
reconciles the sentinel and removes the generated wrappers on the first
shell after upgrading.

BREAKING CHANGE: users relying on the previous default must now run
`set -U __fish_config_op_logging on`. Existing logs in ~/.terminal_history
are left untouched.

functions/__fish_config_op_enabled.fish

@@ -15,6 +15,11 @@
 #   falsy master disables every unset-category component at once.
 #   Unset master with unset category → enabled (active by default).
 #
+#   One exception: __fish_config_op_logging (C5) is opt-in, because it
+#   writes terminal output to disk. Unset or unrecognized means disabled,
+#   and the master switch cannot enable it — only an explicit truthy
+#   value turns logging on.
+#
 # ARGUMENTS
 #   category_variable  Name (without $) of the category opt-out variable:
 #                      __fish_config_op_aliases, __fish_config_op_autoexec,
@@ -24,8 +29,8 @@
 #                      __fish_config_op_greeting
 #
 # EXIT STATUS
-#   0  Component enabled (category explicitly truthy; or category unset and master not falsy)
-#   1  Component disabled (category explicitly falsy; or category unset and master falsy; or no argument with falsy master)
+#   0  Component enabled (category explicitly truthy; or category unset and master not falsy — except C5 logging, which requires an explicit truthy value)
+#   1  Component disabled (category explicitly falsy; or category unset and master falsy; or C5 logging unset; or no argument with falsy master)
 #
 # EXAMPLE
 #   if __fish_config_op_enabled __fish_config_op_aliases
@@ -43,6 +48,12 @@ function __fish_config_op_enabled --description 'Check whether an opinionated co
         return 1
     end
 
+    # C5 logging is opt-in: it writes terminal output to disk, so an unset or
+    # unrecognized value means off — the master switch cannot enable it.
+    if test "$argv[1]" = __fish_config_op_logging
+        return 1
+    end
+
     # Status 3 (garbage) defers to master — an unrecognized value is not an opt-out.
     __fish_variable_check __fish_config_opinionated
     if test $status -eq 1