Persist config backward-compat migrations to load path

[danbarr]

Summary

Loading a config from an explicit path (PathProvider, LoadOrCreateConfigWithPath) that needed a backward-compatibility migration wrote the migrated result to the default XDG path instead of the path it was loaded from. applyBackwardCompatibility called the path-agnostic save(), which always resolves to getConfigPath().

For tests this clobbered the developer's real config file whenever a PathProvider loaded a temp config with a secrets provider set but setup_completed false. This defeated the test isolation that #894 was supposed to deliver: running the full unit suite (e.g. pkg/client's TestSuccessfulClientConfigOperations and TestFindClientConfigs) silently overwrote ~/Library/Application Support/toolhive/config.yaml with a test fixture. It was also a latent correctness bug for any path-based load in production.

• Thread the load path through applyBackwardCompatibility and persist via saveToPath(configPath) so migrations stay on the path the config was loaded from.
• Remove the now-unused save() helper.
• Add a pkg/config regression test that points getConfigPath at a sentinel and asserts a migration-triggering load never touches the default path.

Closes #894

Type of change

• Bug fix

Test plan

• Unit tests (task test)
• Linting (task lint-fix)
• Manual testing (describe below)

Manual: backed up the real config, ran go test -count=1 ./pkg/config/... ./pkg/client/..., and confirmed the config file hash was unchanged afterward. Verified the new regression test fails on the pre-fix code and passes with the fix. Confirmed the full task test suite leaves the real config byte-identical.

Does this introduce a user-facing change?

No. There are no production callers of NewPathProvider today, so the visible impact was limited to test pollution. The fix also closes the latent production bug for any future path-based load.

Special notes for reviewers

While verifying the full suite I found a separate, pre-existing test-isolation gap unrelated to this change: pkg/skills/client's TestNewDefaultClient/falls_back_to_default_URL_when_env_is_empty fails locally when a thv/Desktop server is running, because it stubs the env var but not server discovery. CI is unaffected. I'll address that in a follow-up PR.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 75.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 68.75%. Comparing base (5a8692d) to head (c134c2c).

Files with missing lines	Patch %	Lines
pkg/config/config.go	75.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5416      +/-   ##
==========================================
- Coverage   68.76%   68.75%   -0.01%     
==========================================
  Files         629      629              
  Lines       63922    63920       -2     
==========================================
- Hits        43958    43951       -7     
- Misses      16707    16714       +7     
+ Partials     3257     3255       -2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.