fix(config): retention editor repaint and refusing unsupported key spellings

[Aaronontheweb]

Problem

This PR fixes the retention defects from #2412.

• Blank values under unsupported JSON key forms caused duplicate keys after a save.
• The retention editor did not redraw after the first key, Backspace, paste, or the saved digit.
• Environment warnings missed alternate case and blank values.
• The command rejected comments and trailing commas during a read.
• The new document check ran before the final configVersion assignment, which could add a duplicate key.

Change

• Detect unsupported key forms by key presence and preserve the original file on rejection.
• Match flat keys without case.
• Validate the final document in ConfigEditorSession.Save() after the version assignment and before the file write.
• Set edit state before draft notifications and notify when the draft text stays equal.
• Use the environment configuration provider for override detection.
• Load the mutable JSON dictionary only when a value needs a write.
• Add the config-retention native tape to the light profile, with JSON and CLI assertions.
• Document the final document check and update the operational skill.

Validation

• CLI tests: 2,160 passed, zero failures or skips.
• The command regression failed before the guard moved and passed after the move.
• The real CLI rejects the duplicate, preserves the file bytes, and permits a subsequent read.
• The native retention tape passed three consecutive isolated runs before the base merge. It also passed in the final full profile.
• The tape covers the saved digit, first key, Backspace, bracketed paste, save, and page re-entry.
• Slopwatch: zero issues. The copyright header check passed through pwsh.
• Full light smoke: 29 tapes and 10 scenarios passed.
• Behavioral eval: blocked. The provider type, endpoint, and model ID are unset.

Local tests and the final smoke profile use runtime source at 2b3bffaef. The later commit changes only TOOLING.md.