Make Datadog metric submission explicit

[dayaffe]

Summary

• require sync-metrics callers to choose --submit, --dry-run, or --output-json
• read DD_API_KEY from the environment for direct submission instead of accepting it as a CLI argument
• print a compact JSON receipt after successful submission so automation does not need to transport metric payloads
• document the direct agent/scheduler path and sandbox boundary

Testing

• cargo test --locked
• verified missing/conflicting modes fail before fetching
• verified sync-metrics --help omits --dd-api-key