fix(config): wire dead validate() functions and fix migrate idempotency guards

[bug-ops]

Summary

• Config::validate() now calls 7 subsystem validate() functions that had real invariant checks but were unreachable from the production config-load path (src/bootstrap/mod.rs, src/tui_remote.rs, src/commands/doctor.rs) — only their own unit tests exercised them. validate_pool() was the most severe gap: two code comments elsewhere state, verbatim, that it "rejects an empty [[llm.providers]] list at config-validation time" and treat that as a load-bearing guarantee, but it was never actually invoked outside its own test module. The other six: LlmConfig::validate_stt(), TrajectorySentinelConfig::validate(), GatewayConfig::validate(), UtilityScoringConfig::validate(), FidelityConfig::validate(), AconConfig::validate(). Also added #[must_use] to validate_stt().
• Wiring validate_pool() required seeding Config::default() with one ProviderEntry::default() so --dump-config-defaults and the no-config-file zeph --tui --connect fallback stay self-consistent with the newly enforced invariant, matching the shipped config/default.toml reference (which already ships an active provider).
• Fixed two --migrate-config --in-place steps that re-appended their advisory block on every run instead of converging after one, same defect class as migrate-config: duplicate advisory blocks + silent false-success no-op for orchestration keys #5945: the mcp/mcp.elicitation/mcp max-connect-attempts/retry-and-tool-timeout steps anchored on a raw substring that also matched inside a commented catch-all stub (now gated by section_header_present), and migrate_memory_retrieval_query_bias's guard checked the wrong (uncommented) form of its own commented output.

Closes #5932
Closes #6018

Test plan

• cargo nextest run -p zeph-config: 735/735 passed
• cargo nextest run --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins: 12858/12858 passed, 35 skipped
• cargo nextest run --test daemon_boot --features a2a: 2/2 passed (a2a-gated integration test, confirms Config::default() change doesn't regress daemon boot)
• cargo test --doc --workspace --features "desktop,ide,server,chat,pdf,scheduler": all passed
• cargo +nightly fmt --check: clean
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings: clean
• RUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --workspace --features "desktop,ide,server,chat,pdf,scheduler": clean
• 11 new reproduction tests for the 7 validate() calls (empty pool, duplicate/multiple-default providers, dangling STT provider reference, inverted trajectory/ACON thresholds, invalid gateway webhook timeout, fidelity threshold ordering), all verified to fail pre-fix and pass post-fix
• 11 new idempotency tests for the two migrate-config fixes, plus manual 5x-consecutive --migrate-config --in-place verification against a built binary
• Adversarial critique performed (2 blocking gaps found and fixed: dump-config-defaults self-consistency, a tautological gateway test that didn't exercise the new wiring)
• Code review completed and approved