pixi's `Config` is no longer a parallel struct that duplicates the shared
rattler configuration keys: it is now a thin `#[serde(transparent)]`
wrapper around `rattler_config::config::ConfigBase<PixiConfig>` from the
redesigned (unreleased) rattler_config, where `PixiConfig` is pixi's
tool-specific extension. This proves out the shared-config extension
mechanism end to end.

What moved where:

- Shared keys (default-channels, authentication-override-file,
  tls-no-verify, tls-root-certs, mirrors, build, channel-config,
  repodata-config, concurrency, proxy-config, s3-options, index-config,
  run-post-link-scripts, allow-symbolic/hard/ref-links, loaded_from) now
  live in the upstream `CommonConfig` / `ConfigBase` and are reached
  through `Deref` (`config.mirrors`, `config.concurrency`, ...).
- Pixi-specific keys (pinning-strategy, pypi-config,
  detached-environments, shell, experimental, tool-platform, cache, and
  the deprecated change-ps1/force-activate) moved into the new
  `PixiConfig` extension (`config.extensions.*`), with all serde
  attributes (kebab-case, snake_case aliases, skip_serializing_if
  guards) carried over so the on-disk TOML format is unchanged. New
  accessors `shell()`, `experimental()`, `cache()`, `pinning_strategy()`
  keep call sites terse; existing accessors keep their signatures.
- `tls_root_certs` is promoted to the upstream
  `rattler_config::config::tls::TlsRootCerts` (Webpki/System). The
  legacy "native"/"all" spellings deserialize as aliases of System, and
  pixi keeps its load-time deprecation warnings by inspecting the raw
  TOML document (`Config::from_toml`) and via a clap value parser for
  `--tls-root-certs` / `PIXI_TLS_ROOT_CERTS`. pixi_utils' feature-aware
  fallback logic (native-tls vs rustls) is unchanged; the
  LegacyNative/All match arms collapse into System.
- allow-symbolic-links/allow-hard-links/allow-ref-links use the
  upstream CommonConfig fields (same flat key names, same format).

Extensibility proof points (each covered by tests):

- `Config::from_toml` uses `ConfigBase::<PixiConfig>::from_toml_str`,
  whose two-pass serde_ignored deserialization reports keys unknown to
  BOTH the common config and the extension, so the "Ignoring '...' in
  file" warnings keep working — including for typos of extension keys
  (`pinning-strateggy`) and unknown keys nested in known tables
  (`shell.chnge-ps1`, `pypi-config.index-urll`). New test:
  test_from_toml_reports_unknown_extension_keys.
- `Config::set` now special-cases only the deprecated
  change-ps1/force-activate hard errors, detached-environments
  bool/path parsing (~-expansion), and the cache.* re-validation; the
  former ~400-line match is deleted and everything else — including
  extension keys like `pinning-strategy` — delegates to the upstream
  generic `ConfigBase::set` (TOML round-trip editor). Unknown keys
  produce an error listing all supported keys (shared + extension) from
  the `Config` trait's `keys()`. New test:
  test_generic_set_handles_extension_keys; also verified against the
  built CLI: `pixi config set pinning-strategy semver` writes
  `pinning-strategy = "semver"`.
- `ProxyConfig::default()` no longer reads proxy env vars upstream, so
  pixi_config's tests are hermetic: the whole suite (including
  test_config_merge_multiple) now passes with and without
  HTTPS_PROXY/HTTP_PROXY set.

Dependency patching: a `[patch.crates-io]` block redirects every rattler
crate pixi consumes to the `claude/rattler-shared-config-design-m8d2gb`
branch of conda/rattler (single copy of each crate, verified with
`cargo tree -i rattler_conda_types`). TODO: remove once rattler_config
0.6 is released (see conda/rattler#2557) — this PR must not merge until
then.

Behavior changes (intentional, small):

- `default_channels` is `Option<Vec<NamedChannelOrUrl>>` upstream;
  `Config::default_channels()` keeps returning the configured list or
  the consts::DEFAULT_CHANNELS fallback, and from_toml normalizes an
  explicitly empty list to None to preserve the old merge semantics.
- `mirrors` is an `IndexMap` (was HashMap): deterministic ordering;
  `mirror_map()` signature updated.
- `loaded_from` now lists files in load order (lowest precedence
  first); it previously listed them in reverse.
- Editing a subkey of a non-existent s3-options bucket used to be a
  silent no-op; the generic editor rejects it (S3Options requires all
  three fields). Setting the whole bucket first works as before.
- `pixi config set concurrency '<json>'` used to (buggily) write
  pypi-config; the generic editor handles it correctly.
- PyPIConfig::is_default now also checks allow-insecure-host, so a
  pypi-config containing only allow-insecure-host is no longer dropped
  on save.
- A file containing `tls-root-certs = "native"`/`"all"` still loads
  (with the same deprecation warning), but re-saving it writes the
  canonical `"system"`.

Snapshot diff (config_merge_multiple): Debug output is now nested as
ConfigBase { common, extensions, loaded_from }; default_channels prints
as Some([...]); the (empty, serde-skipped) upstream index_config section
appears; loaded_from order flipped as described above. All values are
identical to the old snapshot.

Tests: cargo test -p pixi_config (55 passed, with and without proxy
env), cargo test -p pixi_utils (72 passed), cargo check --workspace
--all-targets, cargo clippy -p pixi_config/pixi_utils/pixi_cli/
pixi_core/pixi_api/pixi_uv_context --all-targets clean, cargo fmt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EzYs4p6XJDj9QBcNB4ipR7

Now that rattler-build's config PR (prefix-dev/rattler-build#2636) is merged,
align pixi's rattler/rattler-build sources so the shared rattler_config /
rattler_conda_types types unify:

- Drop the conda/rattler [patch.crates-io] block. It pinned the pre-release
  rattler_config 0.5.2 / rattler 0.46 branch, which conflicts with
  rattler-build main (built against the released rattler_config 0.6 /
  rattler 0.47). rattler_config 0.6 is now released, so the patch is obsolete.
- Bump rattler requirements to the released set: rattler 0.47,
  rattler_conda_types 0.48, rattler_config 0.6, rattler_repodata_gateway 0.30.
- Patch all rattler-build crates in the tree to prefix-dev/rattler-build main
  (the merged config update); the crates.io rattler_build_core 0.2.8 still
  pins the old rattler 0.46 and is unusable until a new release is published.

Lockfile re-resolved: a single copy of each shared crate from crates.io,
rattler-build crates from git main, no leftover conda/rattler refs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EzYs4p6XJDj9QBcNB4ipR7