refactor(config): adopt config-loader-facade across the codebase

Issue #1161. Sweeps 127 files to import from
src/config/config-loader-facade.ts instead of unified-config-loader or
utils/config-manager directly.

WRITE callers (32 files): replaced raw saveUnifiedConfig /
mutateUnifiedConfig / updateUnifiedConfig calls with the facade's
cache-coherent wrappers saveConfig / mutateConfig / updateConfig. This
fixes a latent stale-cache window where direct writes through the
underlying loader bypassed the facade's memoization.

READ callers (95 files): mechanical import-path migration only —
function names unchanged because the facade re-exports them. No
behavior change.

Also updated:
- tests/unit/utils/browser/browser-setup.test.ts (DI interface rename)
- src/management/checks/image-analysis-check.ts (dynamic import rename)
- src/web-server/health-service.ts (dynamic require rename)
- src/ccs.ts (path prefix fix from sweep script)

After sweep: zero raw write callers remain outside src/config/. Direct
imports of config-manager remain only for symbols not in the facade
(getConfigPath, getCcsDirSource, etc). Behavior unchanged; full suite
passes 1824/1824.

Out of scope: switching loadOrCreateUnifiedConfig() callers to
getCachedConfig() — needs per-callsite cache-safety analysis. Tracked
as follow-up.

Refs #1161

src/auth/commands/create-command.ts

@@ -12,7 +12,7 @@ import {
   getWindowsEscapedCommandShell,
   stripClaudeCodeEnv,
 } from '../../utils/shell-executor';
-import { isUnifiedMode } from '../../config/unified-config-loader';
+
 import { ProfileMetadata } from '../../types';
 import {
   resolveCreateAccountContext,
@@ -25,6 +25,7 @@ import { exitWithError } from '../../errors';
 import { ExitCode } from '../../errors/exit-codes';
 import { CommandContext, parseArgs } from './types';
 import { stripAmbientProviderCredentials } from './create-command-env';
+import { isUnifiedMode } from '../../config/config-loader-facade';
 
 function sanitizeProfileNameForInstance(name: string): string {
   return name.replace(/[^a-zA-Z0-9_-]/g, '-').toLowerCase();

src/auth/commands/default-command.ts

@@ -5,10 +5,11 @@
  */
 
 import { initUI, color, dim, ok, fail } from '../../utils/ui';
-import { isUnifiedMode } from '../../config/unified-config-loader';
+
 import { exitWithError } from '../../errors';
 import { ExitCode } from '../../errors/exit-codes';
 import { CommandContext, parseArgs } from './types';
+import { isUnifiedMode } from '../../config/config-loader-facade';
 
 /**
  * Handle the default command (set default profile)

src/auth/commands/remove-command.ts

@@ -8,10 +8,11 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { initUI, color, ok, fail, info } from '../../utils/ui';
 import { InteractivePrompt } from '../../utils/prompt';
-import { isUnifiedMode } from '../../config/unified-config-loader';
+
 import { exitWithError } from '../../errors';
 import { ExitCode } from '../../errors/exit-codes';
 import { CommandContext, parseArgs } from './types';
+import { isUnifiedMode } from '../../config/config-loader-facade';
 
 /**
  * Handle the remove command

src/auth/profile-continuity-inheritance.ts

@@ -1,15 +1,16 @@
 import * as fs from 'fs';
-import {
-  getConfigJsonPath,
-  getContinuityInheritanceMap,
-  isUnifiedMode,
-} from '../config/unified-config-loader';
+
 import { warn } from '../utils/ui';
 import InstanceManager from '../management/instance-manager';
 import ProfileRegistry from './profile-registry';
 import { isAccountContextMetadata, resolveAccountContextPolicy } from './account-context';
 import type { ProfileType } from '../types/profile';
 import { getProfileLookupCandidates, resolveAliasToCanonical } from '../utils/profile-compat';
+import {
+  getConfigJsonPath,
+  getContinuityInheritanceMap,
+  isUnifiedMode,
+} from '../config/config-loader-facade';
 
 export interface ProfileContinuityInheritanceInput {
   profileName: string;

src/auth/profile-detector.ts

@@ -21,8 +21,7 @@ import {
   CompositeVariantConfig,
   CompositeTierConfig,
 } from '../config/unified-config-types';
-import { loadUnifiedConfig, isUnifiedMode, getCursorConfig } from '../config/unified-config-loader';
-import { getCcsDir } from '../utils/config-manager';
+
 import { getProfileLookupCandidates, isLegacyProfileAlias } from '../utils/profile-compat';
 import type { CLIProxyProvider } from '../cliproxy/types';
 import { CLIPROXY_PROVIDER_IDS, isCLIProxyProvider } from '../cliproxy/provider-capabilities';
@@ -30,6 +29,12 @@ import { LEGACY_CURSOR_PROFILE_NAME } from '../cursor/constants';
 import { normalizeCopilotModelId } from '../copilot/copilot-model-normalizer';
 import type { TargetType } from '../targets/target-adapter';
 import type { ProfileType } from '../types/profile';
+import {
+  getCcsDir,
+  getCursorConfig,
+  isUnifiedMode,
+  loadUnifiedConfig,
+} from '../config/config-loader-facade';
 export type { ProfileType } from '../types/profile';
 
 /** CLIProxy profile names (OAuth-based, zero config) */

src/auth/profile-registry.ts

@@ -1,15 +1,17 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { ProfileMetadata } from '../types';
-import {
-  loadOrCreateUnifiedConfig,
-  mutateUnifiedConfig,
-  isUnifiedMode,
-} from '../config/unified-config-loader';
+
 import type { AccountConfig } from '../config/unified-config-types';
-import { getCcsDir } from '../utils/config-manager';
+
 import { isValidContextGroupName, normalizeContextGroupName } from './account-context';
 import { createLogger } from '../services/logging';
+import {
+  getCcsDir,
+  isUnifiedMode,
+  loadOrCreateUnifiedConfig,
+  mutateConfig,
+} from '../config/config-loader-facade';
 
 const logger = createLogger('auth:profile-registry');
 
@@ -323,7 +325,7 @@ export class ProfileRegistry {
    * Create account in unified config (config.yaml)
    */
   createAccountUnified(name: string, metadata: CreateMetadata = {}): void {
-    mutateUnifiedConfig((config) => {
+    mutateConfig((config) => {
       if (config.accounts[name]) {
         throw new Error(`Account already exists: ${name}`);
       }
@@ -342,7 +344,7 @@ export class ProfileRegistry {
    * Update account metadata in unified config
    */
   updateAccountUnified(name: string, updates: Partial<AccountConfig>): void {
-    mutateUnifiedConfig((config) => {
+    mutateConfig((config) => {
       if (!config.accounts[name]) {
         throw new Error(`Account not found: ${name}`);
       }
@@ -357,7 +359,7 @@ export class ProfileRegistry {
    * Remove account from unified config
    */
   removeAccountUnified(name: string): void {
-    mutateUnifiedConfig((config) => {
+    mutateConfig((config) => {
       if (!config.accounts[name]) {
         throw new Error(`Account not found: ${name}`);
       }
@@ -372,7 +374,7 @@ export class ProfileRegistry {
    * Set default profile in unified config
    */
   setDefaultUnified(name: string): void {
-    mutateUnifiedConfig((config) => {
+    mutateConfig((config) => {
       const exists =
         config.accounts[name] || config.profiles[name] || config.cliproxy?.variants?.[name];
       if (!exists) {
@@ -386,7 +388,7 @@ export class ProfileRegistry {
    * Clear default profile in unified config (restore original CCS behavior)
    */
   clearDefaultUnified(): void {
-    mutateUnifiedConfig((config) => {
+    mutateConfig((config) => {
       config.default = undefined;
     });
   }
@@ -426,7 +428,7 @@ export class ProfileRegistry {
    * Update account last_used in unified config
    */
   touchAccountUnified(name: string): void {
-    mutateUnifiedConfig((config) => {
+    mutateConfig((config) => {
       if (!config.accounts[name]) {
         throw new Error(`Account not found: ${name}`);
       }

src/auth/resume-lane-diagnostics.ts

@@ -1,11 +1,12 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { getDefaultClaudeConfigDir } from '../utils/claude-config-path';
-import { getCcsDir } from '../utils/config-manager';
+
 import InstanceManager from '../management/instance-manager';
 import ProfileDetector from './profile-detector';
 import { resolveConfiguredContinuitySourceAccount } from './profile-continuity-inheritance';
 import type { ProfileType } from '../types/profile';
+import { getCcsDir } from '../config/config-loader-facade';
 
 export type ResumeLaneKind =
   | 'native'