bug: isolate staged application configuration during nested validator loads

[codeforester]

Parent: #214

Problem

Application configuration staging is process-global. base_app_config_load clears the shared staging maps before every load, while custom validators are public callbacks and may call framework APIs. If a validator loads another application model, that nested load clears values already staged for the outer model.

The outer load can still report success while publishing an incomplete snapshot.

Evidence

Reviewed at commit d064f426681f0e340ff4990ba0c9830084a5fe12.

A focused model used two outer defaults; the validator for the second field loaded an independent inner model. The outer load succeeded, but its first field disappeared:

load=0 first_status=1 first=SENTINEL second_status=0 second=second inner_status=0 inner=inner

This is distinct from the prior scratch-variable collision and per-model exit-status fixes: the loss occurs in the shared staging maps.

Impact

Composable validators can silently discard valid configuration. That makes extension callbacks unsafe and successful load results unreliable.

Acceptance criteria

• Isolate staged values and provenance for each active configuration load.
• Allow a validator to load a different model without erasing either model's values.
• Define and enforce recursive same-model behavior before mutating published state.
• Preserve the last successful snapshot on every failed outer or nested load.
• Add focused regressions for successful nesting, nested failure, and same-model recursion.
• Document the validator reentrancy contract and run ./tests/validate.sh.

Review validation

The existing full validation gate passes (587 BATS tests); no current test nests base_app_config_load inside a validator.