Preserve OAuth projection during config onboarding

[TheGreatAxios]

Summary

• Preserves settings-source provenance through first-run onboarding reloads.
• Keeps CLI --config composed with home OAuth profiles while programmatic settings remain isolated.

Verification

• bun run check passes.
• bun test src/config.test.ts src/tui/onboarding.test.ts passes with 76 tests.

Fixes CL-7116

[linear-code]

CL-7116

[TheGreatAxios]

Review · Approve

Onboarding preserves OAuth projection semantics across config reloads.

No findings.

[TheGreatAxios]

Review · Approve

Records on UnconfiguredConfig whether the settings source was a CLI --config path or a programmatic globalSettingsPath override, so the onboarding reload re-passes --config and only suppresses home OAuth-profile projection when the caller was programmatic.

No findings.

Notes

• Merge this before #706. git merge-tree --write-tree reports a content conflict in src/tui/onboarding.ts:45-55: #706 keeps the overridesSettingsPath gate and swaps in isProgrammaticSettingsOverride, which still returns true for any distinct --config file and so does not fix this bug. Resolve in favour of this branch's provenance logic and drop #706's isProgrammaticSettingsOverride import. src/config/index.ts merges clean; #707 shares no files.
• src/tui/onboarding.ts:47 — when both cliConfigPath and programmaticSettingsPath are set the reload passes the CLI path as globalSettingsPath; harmless since loadConfig only checks for undefined and --config wins, and the combination is test-only.
• Checks: bun run typecheck, bun run lint, bun test src/config.test.ts src/tui/onboarding.test.ts (76 pass). With origin/main:src/tui/onboarding.ts swapped in, the new tests fail with Selected provider "xai/work" is not configured in settings — the reported bug.