fix: reject invalid explicit config paths

[codeforester]

Summary

• validate explicit --config values as expanded, existing, readable regular files before profile or runtime startup
• keep absent profile-owned implicit files optional while making the generic explicit loader strict and race-aware
• preserve stable malformed YAML and non-mapping errors and surface invalid UTF-8 as a safe configuration error
• document the strict explicit-path and optional implicit-file contracts

Validation

• full 253-test suite on Click 8.4.2
• full 253-test suite on Click 8.1.8
• isolated wheel and sdist build and artifact validation
• 314 downstream Base engine tests pass; four unrelated baseline failures reproduce unchanged on current main
• adversarial missing, unreadable, non-regular, tilde, parse-to-load race, YAML-shape, encoding, and no-side-effect coverage

Closes #56