fix(config): harden resolved path serialization

[BunsDev]

Summary

Closes #688.

Harden coven config paths --json so its version 1 contract never labels lossy or relative path strings as resolved.

• resolve Windows drive-relative inputs with platform-aware semantics
• fail closed when a path cannot become absolute or cannot be represented exactly as UTF-8
• fail closed atomically for multi-path surfaces instead of returning partial output
• preserve environment/configuration source attribution on unresolved rows
• remove lossy HOMEDRIVE + HOMEPATH source comparison
• document the UTF-8 and multi-path behavior

Verification

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace --locked
• cargo test -p coven-cli config_paths::tests --locked
• cargo test -p coven-cli --test config_paths --locked
• python3 scripts/check-secrets.py
• python3 scripts/check-coven-privacy.py --range origin/main...HEAD

All passed at 14fcf57. The full workspace suite was rerun from a short exact-head worktree because two unrelated memory-import socket tests exceed Unix SUN_LEN under the longer familiar workspace path.

[Copilot]

Pull request overview

This PR hardens the coven config paths --json (schema coven.config.paths v1) output so that “resolved” paths are always absolute and losslessly representable as UTF-8, failing closed for single- and multi-path surfaces when that contract can’t be met.

Changes:

• Replace lossy Path::display().to_string() serialization with a lossless to_str() gate, reporting affected surfaces as unresolved when UTF-8 cannot be represented exactly.
• Make multi-path surfaces fail closed atomically (no partial paths output) and preserve the originating source when failing.
• Update CLI documentation and add integration coverage for non-Unicode environment-provided paths.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
docs/reference/cli-config.md	Documents the UTF-8 losslessness rule, atomic failure for multi-path surfaces, and platform-aware relative resolution semantics.
crates/coven-cli/tests/config_paths.rs	Adds an integration test ensuring non-Unicode env paths cause unresolved output without partial/lossy paths.
crates/coven-cli/src/config_paths.rs	Implements lossless resolved path serialization, atomic multi-path handling, source-preserving unresolved rows, and Windows drive-relative resolution via platform semantics.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.