refactor(config): collapse thin _load_config copies onto the canonical readers

doctor_live and kanban_decompose carried byte-identical
`try: load_config() or {}` wrappers; local_models wrapped load_config in
_quiet; each is now a direct load_config_readonly() call (read-only callers;
the canonical already fails open and returns a mapping). Tests that patched the
local wrappers patch hermes_cli.config.load_config_readonly instead.

tools/code_execution_tool._load_config read the RAW file, so a managed-pinned
`code_execution.mode` and the DEFAULT_CONFIG keys were invisible at tool
discovery — it now reads load_config_readonly() (behavior change: the managed
overlay applies to execute_code's mode/timeout). onboarding.mark_seen and
credential_lifecycle's config mirror scrub parsed config.yaml with a bare
safe_load; both are read→mutate→write round-trips and use read_user_config_raw,
the documented write-back primitive.

hermes_cli/credential_lifecycle.py

@@ -87,19 +87,18 @@ def _scrub_config_yaml_mirrors(old_value: str, new_value: str | None) -> List[st
     """
     if not old_value:
         return []
-    from utils import atomic_yaml_write, fast_safe_load
+    from utils import atomic_yaml_write
 
-    from hermes_cli.config import get_config_path, require_readable_config_before_write
+    from hermes_cli.config import get_config_path, read_user_config_raw, require_readable_config_before_write
 
     config_path = get_config_path()
     if not config_path.exists():
         return []
     try:
-        with open(config_path, encoding="utf-8") as f:
-            user_config = fast_safe_load(f) or {}
+        user_config = read_user_config_raw(config_path)
     except Exception:
         return []
-    if not isinstance(user_config, dict):
+    if not user_config:
         return []
 
     touched: List[str] = []