refactor(config): turn format detection into a table and split init and the JS loader

[BryanFRD]

Refs #1209. Clears the five rust:S3776 findings in src/config/.

Function	Sonar before	after
Config::auto_detect	17	2
Config::validate_groups	17	4
init::collect_package	16	2
init::init	19	2
loader_js::load_js_ts_config	19	2

"After" is from a local implementation of Sonar's rules that reproduces its figure on 27 of the 31 open findings and never undercounts; Sonar confirms on main. No helper introduced here goes above 8.

What changed

• auto_detect was nine if file exists, push this format blocks. It is now DETECTED_VERSION_FILES, a table of candidate filenames and their format, read in the same order, where a row with two candidates takes the first that exists. That is what the two special cases already did by hand: build.gradle.kts over build.gradle, VERSION over VERSION.txt.
• validate_groups keeps its loop and hands each group to check_group. The continue after a duplicate became an else if, which says the same thing: a member listed twice in its own group is not also reported as belonging to two groups.
• collect_package asked four questions with the same if monorepo { " X" } else { "X" } around each label and the same if path == "." { file } else { "{path}/{file}" } around two defaults. Those are question and under.
• init is its three steps named: ensure_no_config_exists (one chain over every config filename, same message, same order), collect_packages, then the write.
• load_js_ts_config carried both runners inline. The tsx and node paths are run_ts_loader and run_node_loader, moved as they were, error messages untouched, and the shared tail is parse_loader_output.

Verified

auto_detect has fifteen dedicated tests in config/tests.rs, including gradle .kts preference, VERSION preference, several files at once and the no-file case; groups.rs has its own. The interactive prompts in init have no test harness, so that part rests on the diff being a rename of repeated expressions.

cargo test: 1098 + 1493. cargo clippy --all-targets -- -D warnings clean.

[ferrfleet]

Checked each extraction against the code it replaces; all five preserve behaviour.

• detect_versioned_files: row order matches the old push order, and the two multi-candidate rows reproduce the old preference (build.gradle.kts before build.gradle, VERSION before VERSION.txt). The old gradle block guarded on build.gradle || build.gradle.kts and then re-tested .kts; find over the candidates in preference order is the same function.
• check_group: continue → else if is equivalent. A member duplicated inside its own group still reports only the duplicate error, and a member that also appears in an earlier group still reports the multi-group error on its first occurrence there.
• ensure_no_config_exists: chain keeps the old order (all CONFIG_FORMATS, then ts, then js) and find short-circuits on the first hit, so the reported filename is unchanged.
• collect_packages: the empty-name branch inverted cleanly, including the "at least one package is required" re-prompt when the list is empty.
• loader_js: both runners moved verbatim. The tsx message keeps its old inner indentation, which is fine since \ at end of line eats the following whitespace; run_ts_loader still drops the tempdir before propagating the error.

Nit, src/config/init.rs:42: prompt_format still carries the indented/unindented pair by hand, the one copy of the pattern question was introduced to remove:

fn prompt_format(indent: bool) -> String {
    let text = question("Version file format [toml/json/xml/gradle/gomod/txt]", indent);
    loop {
        let input = prompt(&text, "toml");

It also drops the local binding named question, which currently shadows the new function of that name in this file.