Replace 6 scattered consent string comparisons in sdk.ts with calls
to canTrack(), canIdentify(), and includesUserId() from core:

- constructor: consentLevel !== 'none' → canTrack(consentLevel)
- isTrackingDisabled(): === 'none' → !canTrack(level)
- effectiveUserId(): === 'full' → includesUserId(level)
- identify(): !== 'full' → !canIdentify(level)
- alias(): !== 'full' → !canIdentify(level)
- setConsent upgrade detection: string comparison → canTrack()

setConsent() transition-specific checks (→none stops queue, clears
cookies; →anonymous from full clears userId) remain as direct
comparisons — they're state transitions, not capability queries.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Replace 5 consent string comparisons in pixel.ts with calls to
consentAllowsTracking() from core:

- init(): level !== 'none' → consentAllowsTracking(level)
- setConsent(): level !== 'none' → consentAllowsTracking(level)
- startCmpDetection() onUpdate: level !== 'none' → consentAllowsTracking
- startCmpDetection() onDetected: detector.level !== 'none' → same
- canTrack(): level !== 'none' → consentAllowsTracking(level)

The earlier version of pixel.ts had userId/identify checks that needed
includesUserId() and canIdentify(), but those were removed in PR #2846
(pixel identify removal). Only canTrack() is needed now.

Update pixel.test.ts mock to include the canTrack export.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…ons type

autocapture.ts — replace 3 consent string comparisons:
- form submit guard: getConsent() === 'none' → !canTrack(getConsent())
- email hash gate: consent === 'full' → includesUserId(consent)
- link click guard: getConsent() === 'none' → !canTrack(getConsent())

snippet.ts — replace inline literal union 'none' | 'anonymous' | 'full'
with the ConsentLevel type from @imtbl/audience-core. This was the one
place consent values were defined outside the single source of truth.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…tity gates

canIdentify() and includesUserId() had identical implementations
(level === 'full'). Collapse to just canIdentify() — the name covers
both "can I call identify/alias" and "should I attach userId or hash
email", which are the same gate.

Two functions is the right number:
- canTrack(level)    — can this level record events?
- canIdentify(level) — can this level use identity features?

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Consumer apps (e.g. Play) import from @imtbl/audience, not
@imtbl/audience-core. Re-export the two consent capability functions
so consumers can use them without adding a direct core dependency.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Convert the 3 remaining raw consent string comparisons in sdk.ts
setConsent() to use the capability functions:

- level === 'none' (queue stop)    → !canTrack(level)
- level === 'none' (cookie delete) → !canTrack(level)
- level === 'anonymous' && previous === 'full' (userId clear)
  → canIdentify(previous) && !canIdentify(level)

These were left as raw comparisons in the initial refactor because
they're state transitions, but they gate the same capabilities as the
query functions. If a future consent level blocks tracking (like
'none' does), these would silently diverge without this change.

Also fix canTrack mock in pixel.test.ts from a bare arrow to
jest.fn().mockImplementation() so it can be overridden per-test.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Comment referenced the 'none' level specifically, but the check now
delegates to canTrack(), which is the capability source of truth.
Describe the predicate in the same terms so the comment doesn't rot
if another non-tracking level is added.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The previous commit aliased the imported canTrack to avoid colliding
with pixel's pre-existing private method of the same name. Invert
that choice: rename the private method, drop the import alias. The
imported canTrack now reads the same as in autocapture.ts and every
other call site, and isTrackingAllowed better describes the private
method (it also checks isReady, not just consent).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>