fix: return real defaults when codeowners.toml fails to parse

[asyncawaitpromise]

Summary / Background

ReadConfig handed the same default Config to the TOML parser and to its own
error paths. go-toml dereferences a non-nil pointer in place rather than
allocating a replacement (unmarshaler.go, the pointer walk in
walkTable), so a file which failed halfway left its partially parsed
values in the instance the error path then returned.

The caller logs using default config and carries on, with whatever the parser
managed to read before it failed.

Why it matters

A malformed codeowners.toml could turn enforcement off, or widen admin bypass,
while the logs said defaults were in force. The config is a security boundary, so
an error path has to return values that never reflect anything read from the file.

The fix

A fresh instance per call. The parser gets its own, and every error path builds
another.

The nil-section fixups go with it. They only ever ran on the success path, and on
that path they were unreachable: TOML cannot express a null table, so a section
which starts non-nil cannot come back nil.

Note that a shallow struct copy is not enough here. The pointer fields would
still be shared, which is exactly what go-toml merges into.

Verification

A test parses a file whose [enforcement] and [admin_bypass] sections are both
read successfully before a later line fails to parse, then asserts every returned
field equals the real default. Reverting the fix turns it red.

[gemini-code-assist]

Code Review

This pull request introduces the 'Approval Retention' feature, which allows users to configure whether existing approvals are retained across specific types of changes, such as whitespace, comments, formatting, string literals, or renames. The implementation includes updates to the configuration parser, new helper methods for flag resolution, comprehensive unit and integration tests, and updated documentation in the README. Since there are no review comments, I have no additional feedback to provide.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
internal/config/config.go	Separates the TOML decode target from freshly constructed error-path defaults, preventing partially parsed policy values from escaping.
internal/config/config_test.go	Adds a malformed-config regression test that exercises and compares all current Config fields against pristine defaults.
README.md	Updates the displayed test coverage percentage.
internal/git/diff_test.go	Applies a formatting-only alignment adjustment to an existing expected map.

_{Reviews (2): Last reviewed commit: "fix: return real defaults when codeowner..." | Re-trigger Greptile}

[github-actions]

Codeowners approval required for this PR:

• @BakerNet or @zbedforrest