S-135356: Make Cicero public test mode explicit

[EllAchE]

Summary

• Cicero's public sandbox intentionally returns on-screen magic links for any address, so make that state explicit with CICERO_PUBLIC_TEST_MODE.
• Force email and SMS onto their log transports while the mode is active, even if Resend, SMTP, or Twilio credentials are present.
• State in the persistent warning and README that I did not purchase a domain or set up outbound email for the hosted demo. The warning also says that email and phone ownership are not verified and real event data does not belong there.

Browser evidence

Real browser evidence was not captured. The isolated Cicero worktree has no node_modules, and the locked dependency install required to start Next was not authorized. The changed TypeScript and TSX entry points were parsed with Bun instead; CI runs the repository's full checks.

Test plan

• git diff --check
• bun build app/layout.tsx lib/mail/config.ts lib/sms/index.ts --target=node --external '*' --outdir <temporary-directory>
• CI Test
• CI Typecheck
• CI Build

Fixes S-135356

Agent Audit

• Action: create-pr
• Timestamp: 2026-08-21T00:29:26Z
• Agent: codex
• Agent type: codex
• Triggered by: loganharless
• Origin: loganharless@MacBook-Pro-5
• Session: 01a02185-63bf-7fa3-bd04-4125201f3d08
• Source repo: EllAchE/sessionboard-oss
• Worktree: /private/tmp/cicero-diagnosis.9Ccm9O/worktrees/unsafe-public-test-mode-20260820-195810
• Branch: s-135356-unsafe-public-test-mode-20260820-195810
• Head commit: be68fdd
• tmux pane: %734
• tmux session: oc-37150-24842