fix(release): validate non-console config keys with target loader

docs/TOOLS.md

@@ -632,9 +632,14 @@ onto the pointer's copy from the target, past any same-copy re-pin, checked
 against the set's `SHA256SUMS`. `--send` and `--tester-port` follow the pointer.
 When that set is missing, fails its sums, holds no readable argv or already ran
 `--sso`, the run refuses `sso-rollback-flags`. Any activate or rollback also
-refuses `config-console-key` before anything stops when the config holds a
-`console` key the target's `scripts/mosaic-config.mjs validate` refuses (a copy
-before row 192 refuses the key). The message says to remove the key first. So a
+refuses `config-console-key` before anything stops when the target's
+`scripts/mosaic-config.mjs validate` refuses the config, including a non-console
+key. Every existing parseable config is checked; a missing file passes. A target
+without a loader accepts only the oldest top-level keys: `configVersion`,
+`environment`, `dataRoot`, and `execution`; any later key refuses. The refusal
+names the rejected key and says to restore the config.json backup first. A
+`console` or `federation` key keeps row 203's message, which says the config
+holds a console or federation key. So a
 window re-pins to row 192 or later before it writes the key, and a rollback past
 row 192 removes the key first.