config.ts: 5 functions exceed halstead.effort fail threshold (loadConfig, loadConfigWithProvenance, resolveConsent, promptForConsentIfNeeded, resolveSecrets)

[carlos-alm]

Context

Found during titan-forge phase 14 gauntlet audit of src/infrastructure/config.ts (rule 1, pillar I).

Problem

5 functions exceed the halstead.effort FAIL threshold (>15000) while staying within warn-only range on cognitive/cyclomatic/maxNesting/mi/sloc:

• loadConfig — effort=41704.73 (cognitive=21, cyclomatic=15, maxNesting=4)
• loadConfigWithProvenance — effort=27823.08 (cognitive=19, cyclomatic=14)
• resolveConsent — effort=29400.04 (cognitive=18, cyclomatic=13)
• promptForConsentIfNeeded — effort=27391.63 (cyclomatic=12)
• resolveSecrets — effort=17143.67 (mi=46.7, the only function in the file dipping under the mi=50 warn line)

Suggested fix

Per the gauntlet recommendation: split loadConfig's four merge layers (global / project / env / secrets) into named per-layer functions to bring halstead.effort down across the board.

Scope note

Not fixed in phase 14 (titan-forge) — that phase was scoped specifically to the applyExcludeTestsShorthand DEFAULTS-mutation correctness bug (#1725) plus the consent glob-matching dedupe, and is flagged HIGH RISK as a real behavior change, not a refactor. The gauntlet recommendation itself describes this halstead-effort cleanup as "opportunistic" (lowest priority of the three findings for this file). No later phase in sync.json revisits src/infrastructure/config.ts, so filing this so the finding isn't lost.