fix(config): warn instead of throw on validation failure

[gfargo]

User report: every coco command crashes with `Invalid project config` when the merged config (defaults + XDG + git + project + env) fails schema validation. The throw originated from `loadProjectJsonConfig` but the offending fields are often inherited from EARLIER layers (XDG, git config) — so the error pinned blame on the wrong source AND a stale field anywhere in the chain takes down the whole tool.

The error

```
Error: Invalid project config
cause: data/service must NOT have additional properties,
data/service/requestOptions/timeout must be number,
data/service/requestOptions/maxRetries must be number,
data/service must have required property 'endpoint',
data/service must match a schema in anyOf
```

Hit during `coco ui --repo /tmp/scenario` testing this morning. Reproducible against any real-world XDG config whose service shape has drifted from the strict schema. Adding ANY local `.coco.config.json` re-triggers validation of the merged result — inherits invalid XDG service — crashes.

Fix

`loadProjectJsonConfig` no longer throws. Instead:

1. Logs a clear warning to stderr with:
   • The path of the local file that triggered validation
   • The specific schema errors
   • A note that validation runs against the MERGED config — the issue may be in any layer
2. Applies the merge anyway so the user's intent flows through
3. Lets downstream components guard locally against shapes they can't handle

Why this is the right answer

• Throwing turns "you have a stale field somewhere" into "the tool fails to boot." Brutal cost for a recoverable situation.
• Coco has sane defaults. A drifted service shape can fall back gracefully.
• A downstream consumer that GENUINELY needs a valid service shape can throw a localized error at use-time with concrete next steps, rather than burying the user in opaque "Invalid project config" at boot.

Verified

Local repro of the user's exact error now produces:

```
[coco] Warning: config validation issues detected (continuing with merged config).
Local file: .coco.config.json
Schema issues: data/service must NOT have additional properties, ...
Fix the offending fields to silence this warning. The validation runs against
the merged result of every config source (defaults, XDG, git, project, env) —
the issue may be in any of those, not necessarily this file.
Graph Commit Date Author Message

•  f13c3f2    2026-05-14  Coco Test  chore: baseline app scaffold  [HEAD -> main]
  

•  a817234    2026-05-14  Coco Test  chore: initial commit
  

```

Warning fires (so the user knows to fix it eventually) but the tool keeps going.

Out of scope

The drifted schema itself. The error suggests the service-config schema has gotten stricter than real configs in the wild — worth an audit follow-up to either loosen the schema or document the new required shape. This PR just stops the bleed.

Test plan

• `npm run lint` clean
• `tsc --noEmit` clean
• `npm run test:jest` — 1666 tests pass (+1 new regression test)
• Manual: the user's blocked workflow (`coco ui --repo /tmp/conv-test`) now boots