fix: restrict project config trust boundary

[zc277584121]

Summary

• restrict project-local .memsearch.toml to low-risk local indexing settings
• keep credentials, network endpoints, provider routing, prompt files, plugin automation, and remote model selection controlled by global config or explicit CLI flags
• update tests that previously relied on project-local plugin automation settings

Tests

• uv run python -m pytest tests/test_config.py tests/test_cli_error_handling.py
• uv run python -m pytest tests/test_maintenance_runner.py::test_plugin_maintenance_runner_uses_global_config tests/test_skills.py::test_config_set_paths_parses_json_list
• uv run ruff check src/ tests/ && uv run ruff format --check src/ tests/
• uv run python -m pytest

Addresses #594.