Circuit breaker opt-in default

A deploy upgrades a shared resilience LIBRARY (circuit breaker / retry) used by the orders service from 3.x to 4.x. The team's own feature flags are untouched. Forty minutes after deploy, during a brief downstream blip, orders melts down far worse than usual: a tiny 1% downstream error rate amplifies into a 40% orders error rate and a retry storm, where before the same blip was a non-event. Dashboards: outbound retry count to the downstream is ~5x historical; the circuit breaker never opens. Context: library 4.x changed the DEFAULT circuit-breaker behavior, the breaker is now OPT-IN (disabled unless explicitly enabled) where 3.x had it ON by default, and the upgrade didn't add the now-required enable flag. Triage and mitigate.