fix(config): validate collection document wrappers

[sturlese]

Summary

This bughunt fix validates the document wrappers in models.yaml and usecases.yaml, keeping every malformed configuration inside the path-qualified ConfigError boundary.

Bug

Truthy scalar collection values such as models: 7 or usecases: 7 reached the item iterator and raised an uncaught TypeError. Unknown top-level keys were silently ignored even though configuration loading is documented as strict.

Root cause

The loader validated the top-level YAML mapping and each collection item, but extracted the collection with .get(...) without validating the wrapper's allowed keys or value type.

Fix

• Require each collection document to contain only its expected top-level key.
• Accept a list or null/missing collection while preserving existing empty-document behavior.
• Convert scalar collections and unknown keys, including non-string YAML keys, into actionable ConfigError messages that name the file.
• Quote unknown keys, name the expected key and received type, and escape configuration errors before Rich renders them.

Testing

• Selective source stash confirmed the scalar and unknown-key regressions fail against the previous loader.
• .venv/bin/python -m pytest tests/test_store_config.py tests/test_cli_and_html.py -q — 67 passed.
• .venv/bin/python -m pytest --cov=flightdeck --cov-fail-under=85 — 254 passed, 94.41% coverage.
• .venv/bin/ruff check src tests — passed.
• Build Squad audit, contract, and UX re-reviews — approved with no remaining P1/P2 or Medium/High findings.
• Strong-model adversarial refutation — approved with no remaining Medium/High findings.
• Offline demo, ledger verification, and dashboard artifact check — passed.

[sturlese]

Adversarial gate: PASS

The first gate found two issues in the new error path: diagnostics were not fully actionable, and a hostile YAML key such as "[/]" could make Rich raise MarkupError while rendering the ConfigError. The final patch quotes unknown keys, names the expected key and received type, and escapes configuration errors at the CLI boundary.

Final evidence for commit ecd9ce01f720e3cea11bf0a8098d42c7c69ead2a:

• Focused config/CLI suite: 67 passed.
• Full suite: 254 passed with 94.41% coverage.
• Ruff, diff checks, offline demo, ledger verification, and dashboard artifact check: passed.
• Build Squad audit re-review: APPROVE, no Medium/High findings.
• Build Squad contract re-review: APPROVE across 37 hostile wrapper/CLI checks.
• Build Squad UX re-review: APPROVE, no remaining P1/P2 findings.
• Strong-model final refutation: APPROVE, no Medium/High findings.

The pre-existing PyYAML duplicate-key behavior and non-YAML file-read errors were noted as separate future hardening and were not introduced or widened by this PR.