refactor(config): adopt config-loader-facade across the codebase

Issue #1161. Sweeps 127 files to import from
src/config/config-loader-facade.ts instead of unified-config-loader or
utils/config-manager directly.

WRITE callers (32 files): replaced raw saveUnifiedConfig /
mutateUnifiedConfig / updateUnifiedConfig calls with the facade's
cache-coherent wrappers saveConfig / mutateConfig / updateConfig. This
fixes a latent stale-cache window where direct writes through the
underlying loader bypassed the facade's memoization.

READ callers (95 files): mechanical import-path migration only —
function names unchanged because the facade re-exports them. No
behavior change.

Also updated:
- tests/unit/utils/browser/browser-setup.test.ts (DI interface rename)
- src/management/checks/image-analysis-check.ts (dynamic import rename)
- src/web-server/health-service.ts (dynamic require rename)
- src/ccs.ts (path prefix fix from sweep script)

After sweep: zero raw write callers remain outside src/config/. Direct
imports of config-manager remain only for symbols not in the facade
(getConfigPath, getCcsDirSource, etc). Behavior unchanged; full suite
passes 1824/1824.

Out of scope: switching loadOrCreateUnifiedConfig() callers to
getCachedConfig() — needs per-callsite cache-safety analysis. Tracked
as follow-up.

Refs #1161

tests/unit/utils/browser/browser-setup.test.ts

@@ -111,7 +111,7 @@ describe('browser setup', () => {
 
     const deps: BrowserSetupDeps = {
       getBrowserConfig: () => config.browser,
-      mutateUnifiedConfig: (mutator) => {
+      mutateConfig: (mutator) => {
         mutator(config);
         return config;
       },
@@ -166,7 +166,7 @@ describe('browser setup', () => {
 
     const deps: BrowserSetupDeps = {
       getBrowserConfig: () => config.browser,
-      mutateUnifiedConfig: (mutator) => {
+      mutateConfig: (mutator) => {
         mutator(config);
         return config;
       },