migrate-config --in-place not idempotent: second run duplicates section headers and keys

[bug-ops]

Description

Running migrate-config --in-place twice on the same config file corrupts the output. The second run appends additional section-header comments inline on the existing [section] line and duplicates previously added commented keys.

Reproduction Steps

1. Create a minimal config: echo '[agent]' > /tmp/test.toml
2. Run first migration: cargo run --features full -- migrate-config --config /tmp/test.toml --in-place
3. Inspect file — OK so far: [agent]# comment... with commented keys below
4. Run second migration: cargo run --features full -- migrate-config --config /tmp/test.toml --in-place
5. Observe: outputs "19 entries added" (should be 0); file now contains:
   • [agent]# comment...# comment... (header comment duplicated inline)
   • Duplicate # max_tool_iterations = 10 and # budget_hint_enabled = true entries

Expected Behavior

Second run reports "0 entries added" (or is silent) and the file is identical to after the first run.

Actual Behavior

Second run reports "19 entries added, sections: none". The section header line is mutated to append the comment block again. Previously added commented keys are duplicated in the file. The TOML remains parseable (comments inline after [section] are valid TOML) but the file becomes confusing for manual editing — a user who uncomments an entry may activate the wrong copy.

Environment

• Version: 0.19.1 (HEAD 14f2b73)
• Features: full
• Platform: macOS

Logs / Evidence

After second run, first lines of migrated config:

[agent]# Inject <budget> XML...# name = "Zeph"# Inject <budget> XML...# max_tool_iterations = 10

# budget_hint_enabled = true

# max_tool_iterations = 10

# budget_hint_enabled = true

Root cause: the migration scanner likely uses the [section] line itself as an anchor for insertion, rather than tracking which entries are already present in the file as commented lines.