security: isolate lifecycle config from consumer mappings

[codeforester]

Summary

• stop plain ConfigLoader mappings from changing environment, debug, or temp-retention lifecycle state
• keep validated ConfigSnapshot.framework as the explicit lifecycle boundary
• add regression coverage and migration documentation

Validation

• pytest -q tests/test_app_run_metadata.py tests/test_batteries_included_config.py
• ruff format/check for changed files
• git diff --check

Fixes #264