fix(funnel): use raw Cloud Run URL until funnel.ruv.io cert lands

funnel.ruv.io's TLS cert has not yet provisioned (Cloud Run domain
mapping created 2026-07-10 18:33 UTC; Google's cert issuance is async
and still pending as of this commit — verified: curl to funnel.ruv.io
returns curl exit 35 / HTTP 000, raw Cloud Run URL returns 200).

Every client fetch to messages/events/click was silently timing out
(by design — fail-silent), so:
  - the remote 23-message pool never reached any installed CLI
  - message-transport's cache file never got created
  - rotation only ever showed the 3 static in-code disclosure variants

All three endpoint defaults now point at the raw Cloud Run URL:
  https://cognitum-analytics-63rzcdswba-uc.a.run.app/v1/{events,messages,click}

Marked TEMP in comments. Flip back to funnel.ruv.io once its cert is live
(monitor: curl -o /dev/null -w '%{http_code}' https://funnel.ruv.io/v1/messages).

## Live verification performed this commit

1. Forced message-pool refresh — 23/23 messages accepted, 0 rejected
2. Selected messages across 8 consecutive 20s rotation slots — 8 distinct
   ids returned (7 educational + 1 promotional), confirming rotation moves
3. Impressions queued locally (8/8), consent-gated
4. Flushed queue to live server — 8/8 accepted, queue drained to 0
5. Fired the click-redirect for the selected promotional message with a
   forged CF-IPCountry: CA header — 302 to agentics.org with UTM+fid
   intact
6. Firestore confirmed both events landed:
     promo_impression  messageId=promo-agentics-community
     promo_open        messageId=promo-agentics-community  country=CA
                        via=click-redirect
7. Total promo_impression docs in funnel_events: 9 (8 new + 1 prior)

Co-Authored-By: RuFlo <ruv@ruv.net>

v3/@claude-flow/cli/src/funnel/attribution.ts

@@ -46,7 +46,9 @@ export interface AttributionInput {
  */
 const CLICK_ENDPOINT_BASE =
   process.env.RUFLO_FUNNEL_CLICK_ENDPOINT ??
-  'https://funnel.ruv.io/v1/click';
+  // TEMP: funnel.ruv.io TLS cert still provisioning — raw Cloud Run URL
+  // until it lands, then flip back to funnel.ruv.io.
+  'https://cognitum-analytics-63rzcdswba-uc.a.run.app/v1/click';
 
 /**
  * Return `url` with UTM parameters appended, and — when telemetry consent is

v3/@claude-flow/cli/src/funnel/event-transport.ts

@@ -41,7 +41,10 @@ const FLUSH_STATE_FILE = 'funnel-events-flush.json';
  */
 export const DEFAULT_ENDPOINT =
   process.env.RUFLO_FUNNEL_EVENTS_ENDPOINT ??
-  'https://funnel.ruv.io/v1/events';
+  // TEMP: funnel.ruv.io TLS cert is still provisioning (Cloud Run domain
+  // mapping created 2026-07-10; async on Google's side). Using the raw
+  // Cloud Run URL until the cert lands, then flip back to funnel.ruv.io.
+  'https://cognitum-analytics-63rzcdswba-uc.a.run.app/v1/events';
 
 /** Cap per POST — server enforces its own limits too; this is a safety net. */
 export const MAX_BATCH = 100;

v3/@claude-flow/cli/src/funnel/message-transport.ts

@@ -40,7 +40,9 @@ const FETCH_TIMEOUT_MS = 4_000;
 /** Endpoint the client hits — overridable for staging / self-hosted. */
 export const DEFAULT_MESSAGES_ENDPOINT =
   process.env.RUFLO_FUNNEL_MESSAGES_ENDPOINT ??
-  'https://funnel.ruv.io/v1/messages';
+  // TEMP: funnel.ruv.io TLS cert still provisioning — raw Cloud Run URL
+  // until it lands, then flip back to funnel.ruv.io.
+  'https://cognitum-analytics-63rzcdswba-uc.a.run.app/v1/messages';
 
 interface CacheEnvelope {
   _ts: number;