`BraveStatsUpdater` is a browser-process singleton; its 3-second startup timer reads `kStatsReportingEnabled` without synchronising against `BraveOriginPolicyManager`. Make the updater observe the manager directly and defer the timer behind a two-phase gate (referrals barrier + `OnBravePoliciesReady`), so the startup ping cannot fire before the policy bundle is merged into local state. Resolves: https://github.com/brave/brave-browser/issues/55811