feat: surface config diagnostics in clients - #198

Review: approved ✅

The consumer side of #197, and it holds the same discipline: clients are projections of the shared app-server DTO and do not re-read settings themselves.

That constraint is the whole point. If deepcode doctor, Desktop About, VS Code, and the LSP bridge each re-read and re-merged settings to display diagnostics, they'd each need their own copy of the trust and layering rules — and any drift would mean the diagnostics lie, which is worse than not having them. One DTO, four renderers.

What I checked

• The report stays value-free everywhere it surfaces, so the feat: add trust-aware config diagnostics #197 no-exfiltration property survives all the way to the UI. Easy to lose at exactly this layer while making a report "more useful".
• Capability negotiation on the VS Code command means an older app-server degrades cleanly instead of erroring.
• Trust/layer/gate/schema are the four dimensions a user actually needs to answer "why is my setting not taking effect?" — historically an opaque, expensive support question in this repo.
• Covered in the browser fixture journey from test: automate desktop protocol journey #193, so the Desktop surface is exercised, not just wired.

Validation: CI green; full suite green locally at the stack tip.