feat: add typed settings registry and CLI

[SarthakWade]

Closes #153

Summary

• add a shared typed settings registry with defaults, platform scope, restart behavior, and enforced access classes
• add local-only config list, describe, get, set, and reset commands while preserving the existing macOS startup-presentation value
• add private, bounded, versioned, atomically updated XDG storage on Linux
• keep security invariants and credential authorization outside configurable settings
• document the contract and add parser, storage, permission, concurrency, MCP-boundary, and cross-engine coverage

Security

• user-only settings are omitted from agent discovery and rejected as unknown below the CLI parser
• agent-readable settings cannot be mutated by agents
• Linux storage requires current-user ownership, 0700/0600 permissions, regular single-link files, no-follow descriptor-relative access, locking, bounded canonical JSON, and durable atomic replacement
• config remains unavailable over the browser protocol and MCP

Verification

• pnpm test
• pnpm test:runtime
• pnpm test:npm
• pnpm test:e2e:linux
• pnpm build
• pnpm test:e2e:mac
• pnpm dlx prettier@3.6.2 --check README.md apps/headless/docs/COMMANDS.md apps/headless/docs/P0.md docs/roadmap/architecture-decisions.md
• bash -n apps/headless/Tests/linux-e2e.sh apps/headless/Tests/macos-e2e.sh
• git diff --check