perf(audience): move SyncConsentToBackend out of _initLock

Fires the fire-and-forget consent PUT after the lock releases. JSON
serialisation, dictionary allocation, and Task.Run scheduling no longer
block concurrent SetConsent / Identify / Reset callers.

Why: the call's three args are already local snapshots and the control
client it reads is not _initLock-protected anyway (Shutdown disposes it
without the lock, relying on _shutdownCancellationSource for safety).

Tests: all 181 audience unit tests pass. No test changes — Identity.Reset
still runs before the PUT, so the revocation regression guard still holds.

Addresses Cursor Bugbot comment on #700.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ImmutableJeffrey

src/Packages/Audience/Runtime/ImmutableAudience.cs

@@ -360,16 +360,21 @@ public static void SetConsent(ConsentLevel level)
         {
             if (!_initialized) return;
 
-            // Serialise the transition under _initLock so the state swap and the
-            // queue purge / downgrade are atomic against concurrent SetConsent
-            // / Identify / Reset callers.
+            // Serialise the state swap, consent persist, and queue purge / downgrade
+            // under _initLock so concurrent SetConsent / Identify / Reset callers see
+            // a consistent pair. The backend PUT is fire-and-forget and runs outside
+            // the lock — its args are local snapshots and SyncConsentToBackend already
+            // tolerates Shutdown racing _controlClient disposal via _shutdownCancellationSource.
+            AudienceConfig config;
+            string? anonymousIdForPut;
+
             lock (_initLock)
             {
                 if (!_initialized) return;
 
-                var config = _config;
+                var currentConfig = _config;
                 var queue = _queue;
-                if (config == null) return;
+                if (currentConfig == null) return;
 
                 var previousState = _state;
                 var previous = previousState.Level;
@@ -378,9 +383,9 @@ public static void SetConsent(ConsentLevel level)
                 // Snapshot the anonymousId BEFORE Identity.Reset (on downgrade to
                 // None) wipes the file. The PUT audit trail needs it to record
                 // whose consent changed.
-                var anonymousIdForPut = previous == ConsentLevel.None
-                    ? Identity.GetOrCreate(config.PersistentDataPath!, level)
-                    : Identity.Get(config.PersistentDataPath!);
+                anonymousIdForPut = previous == ConsentLevel.None
+                    ? Identity.GetOrCreate(currentConfig.PersistentDataPath!, level)
+                    : Identity.Get(currentConfig.PersistentDataPath!);
 
                 // Atomic swap: both Level and UserId publish together. The next
                 // Track/Identify read observes the pair consistently.
@@ -391,28 +396,30 @@ public static void SetConsent(ConsentLevel level)
                 try
                 {
                     // PersistentDataPath is validated non-null in Init; compiler can't propagate that.
-                    ConsentStore.Save(config.PersistentDataPath!, level);
+                    ConsentStore.Save(currentConfig.PersistentDataPath!, level);
                 }
                 catch (Exception ex) when (ex is IOException || ex is UnauthorizedAccessException)
                 {
                     Log.Warn($"SetConsent — failed to persist consent level: {ex.GetType().Name}: {ex.Message}. " +
                              "In-memory level is updated but will revert on next launch.");
-                    NotifyErrorCallback(config.OnError, AudienceErrorCode.ConsentPersistFailed,
+                    NotifyErrorCallback(currentConfig.OnError, AudienceErrorCode.ConsentPersistFailed,
                         $"Consent persist failed: {ex.Message}");
                 }
 
                 if (level == ConsentLevel.None)
                 {
                     queue?.PurgeAll();
-                    Identity.Reset(config.PersistentDataPath!);
+                    Identity.Reset(currentConfig.PersistentDataPath!);
                 }
                 else if (previous == ConsentLevel.Full && level == ConsentLevel.Anonymous)
                 {
                     queue?.ApplyAnonymousDowngrade();
                 }
 
-                SyncConsentToBackend(config, level, anonymousIdForPut);
+                config = currentConfig;
             }
+
+            SyncConsentToBackend(config, level, anonymousIdForPut);
         }
 
         // Fire-and-forget PUT /v1/audience/tracking-consent. Failures do not