feat(config): config module with idempotent bootstrap and strict v1 validation (#1)

- scripts/mosaic-config.mjs: bootstrap | validate | env operations
- Exclusive creation (O_EXCL 'wx'); existing config validated, never rewritten
- Strict schema: unknown keys rejected, configVersion===1, backend docker only
- dataRoot guards: absolute, canonical, not root/home/ancestor-of-config
- MOSAIC_CONFIG override for sandboxed tests; exit codes 0/2/3
- scripts/bootstrap.sh: explicit bootstrap entry point

Closes #1

scripts/bootstrap.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Explicit, idempotent configuration bootstrap.
+#
+# Creates ~/.config/mosaic-dev/config.json (or $MOSAIC_CONFIG) only when
+# absent. An existing configuration is validated, never modified.
+# Normal run paths (build/hello/verify) deliberately do NOT auto-bootstrap:
+# missing configuration is an error there, not something to invent.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+exec node scripts/mosaic-config.mjs bootstrap