fix(canary-phase10): escape geo wrapping parens for MarkdownV2 before rollup

Audit catch (code-reviewer agent). formatGeo emitted literal `(` and `)`
around the geo block (e.g. `(Toronto, CA)`), but `(` and `)` are in the
MarkdownV2 reserved set when used outside `[text](url)` link delimiter
positions. Telegram would reject the entire message with
`Bad Request: can't parse entities: Character '(' is reserved`.

Fix: write the wrapping parens as `\(` and `\)` literals in the three
parens-construction switch arms. The dynamic field values inside still
flow through EscapeMD as before. The `[View full event timeline](url)`
inline link is left alone — its `(` `)` ARE link delimiters and per V2
rules must NOT be escaped (only `)` and `\` inside the URL portion need
escapes, and our manage URL has neither).

Regression test: TestSender_Send_MessageContainsKeyFields now asserts
`require.Contains(text, \\(Toronto, CA\\))` so substring matching can't
hide future regressions on the wrapping parens.

PROJECTS/beginner/canary-token-generator/backend/internal/notify/telegram/sender.go

@@ -249,11 +249,11 @@ func formatGeo(evt *event.Event) string {
 	var parens string
 	switch {
 	case city != "" && country != "":
-		parens = "(" + EscapeMD(city) + ", " + EscapeMD(country) + ")"
+		parens = `\(` + EscapeMD(city) + ", " + EscapeMD(country) + `\)`
 	case country != "":
-		parens = "(" + EscapeMD(country) + ")"
+		parens = `\(` + EscapeMD(country) + `\)`
 	case city != "":
-		parens = "(" + EscapeMD(city) + ")"
+		parens = `\(` + EscapeMD(city) + `\)`
 	}
 	if parens == "" && asnOrg == "" {
 		return ""

PROJECTS/beginner/canary-token-generator/backend/internal/notify/telegram/sender_test.go

@@ -186,8 +186,11 @@ func TestSender_Send_MessageContainsKeyFields(t *testing.T) {
 	)
 	require.Contains(t, text, "envfile")
 	require.Contains(t, text, `203\.0\.113\.45`, "IP dots escaped")
-	require.Contains(t, text, "Toronto")
-	require.Contains(t, text, "CA")
+	require.Contains(t,
+		text,
+		`\(Toronto, CA\)`,
+		"geo wrapping parens escaped (V2 reserved chars)",
+	)
 	require.Contains(t, text, `Cloudflare, Inc\.`, "asn_org . escaped")
 	require.Contains(t, text, "View full event timeline", "manage link present")
 	require.Contains(t,