feat(cli): thread Config into the resume path

[ecalifornica]

Part of #184 (PR 10 of the plan there). Stacked on #202. path-cli only.

What

• run() passes &Config to cmd_resume::run. run_with_strategy takes it and hands it to resolve_input and project_into_harness. Both transitional Config::load() calls in cmd_resume are gone.
• The projectors it calls (cmd_export::project_claude and siblings) already take &Config, so the resolvers for every harness now come from the one Config extracted in run().
• A Pathbase input calls derive::pathbase_fetch_to_doc(config, …), so the credentials path and the server URL come from the same Config.
• Config is public and config is a public module. run_with_strategy is the public entry point that tests/resume.rs drives with a RecordingExec, so the parameter type must be nameable from the test crate. Both items are #[doc(hidden)]: the type is a test seam, not API. The fields stay crate-private, so Config::load is the only constructor outside the crate.
• One transitional load remains under resolve_input: cache.rs resolves the document cache through the free config_dir(), so a cache-id or Pathbase input still reads $TOOLPATH_CONFIG_DIR on that path. The cache PR owns it.

Notes

• The $PATH reads in cmd_resume stay (binary_on_path, used by the harness lookup and the cursor launcher check). A binary lookup is execution environment, not configuration, so $PATH is not a Config field.
• cmd_resume is module-gated (#![cfg(not(target_os = "emscripten"))], plus the same gate on the module declaration and the Resume arm), so the emscripten build is unaffected.

Behavior change

• None. The same environment reaches the same resolvers. It is read once, in run().

Tests

• The project_into_harness unit test injects a Config rooted at a tempdir. It sets no $HOME and takes no TEST_ENV_LOCK.
• The run_with_strategy unit test injects the same Config. It keeps the $PATH guard and the lock, because $PATH is process-global state.
• The resolve_input unit tests inject a Config. The Pathbase-fetch test needs no environment guard at all. The cache-hit test and the unresolvable-input test still set $TOOLPATH_CONFIG_DIR, because cache.rs reads it.
• ScopedHomeForResume is deleted. No unit test in cmd_resume writes $HOME.
• The integration tests in tests/resume.rs keep ScopedHome: the cache path still reads $TOOLPATH_CONFIG_DIR. They pass ScopedHome::config(), the Config the CLI extracts at its composition root, loaded under the guard.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

🔍 Preview deployed: https://cd40d0c2.toolpath.pages.dev