Keep detached configuration projections independent

[bigboateng]

Summary

Detached installations previously reused one mode-resolved configuration bundle for both the external controller and any committed repository package. When those sources evolved independently, a normal update could overwrite one projection from the other and make configuration drift interfere with later Boatstack operations.

This change:

• models embedded, detached-only, and hybrid configuration topology explicitly;
• records repository, external snapshot, synthesized, or legacy authority and reports source relationships;
• adds fingerprinted config-rebind preview/apply repair;
• keeps detached-only updates outside the repository and generates hybrid projections independently;
• routes configuration mutations through declared authority and blocks cross-authority migration and export;
• limits divergence errors to explicit configuration-dependent Boatstack operations;
• preserves schema-v2 attachments and existing delivery/runtime state.

A static configuration-event registry now makes new unclassified readers, writers, renderers, resolvers, or admission sites fail CI.

Test Plan

• go build ./...
• go vet ./...
• go test ./...
• python3 -m unittest discover -s .github/tests -p 'test_*.py'
• release-note validation and committed-diff preflight
• detached authority positive, negative, relation, bypass, and interruption conformance
• confidentiality and generated-command parity checks

Release note: release-notes/2026-08-10-detached-configuration-authority.md