feat(config): support env placeholders in sync source/target paths

[shpoont]

Summary

Adds support for environment-variable placeholders in sync source/target paths, with docs/spec first and strict validation behavior.

Supported placeholders

• $VAR
• ${VAR}

Rules

• expansion happens before path normalization/validation
• missing or empty env vars are errors (DFM_CONFIG_PATH_ENV_VAR_UNDEFINED)
• expanded paths must remain relative and non-escaping
• [path] scoping uses post-expansion target roots

What changed

Docs/spec/contracts

• user docs updated (README, getting-started, config guide, commands, faq)
• internal specs updated (decisions, cli-and-config-spec, decision-matrix, open-questions)
• contracts updated (validation-errors.md, config-schema.json)

Implementation

• config validation now expands and validates env placeholders for syncs[].source and syncs[].target
• new exported helper config.ExpandSyncPath(...) used where sync roots are resolved
• root selection/scoping now evaluates expanded paths
• added new error code: DFM_CONFIG_PATH_ENV_VAR_UNDEFINED

Validation

• go test ./...
• go test -tags=contract ./...
• go test -tags=integration ./...
• bash scripts/ci/run-static-checks.sh true
• bash scripts/ci/run-tests.sh contract linux true

Manual spot checks

• layered source config using ./$HOSTNAME/$USER resolves and runs
• missing env var fails with DFM_CONFIG_PATH_ENV_VAR_UNDEFINED