refactor(config): Route all config I/O through AppController

Eliminates 22 call sites that bypassed the AppController state owner
and read/wrote config.toml directly. AppController is now the single
source of truth for self.config; gui_2.py, commands.py, etc. go
through controller.save_config() / controller.load_config().

Production changes:
- src/models.py: rename load_config -> _load_config_from_disk,
  save_config -> _save_config_to_disk (private I/O primitives)
- src/app_controller.py: add public load_config()/save_config() methods
  that own the state. Update 3 internal call sites and 3 ConductorEngine
  call sites to pass max_workers from self.config
- src/multi_agent_conductor.py: ConductorEngine.__init__ now takes
  max_workers as a parameter (caller responsibility, not I/O primitive)
- src/external_editor.py: get_default_launcher() takes config as a
  parameter; gui_2.py:1311,4776 pass app.config
- src/gui_2.py: 17 sites of models.save_config(X.config) replaced with
  X.save_config() (delegates via __getattr__ to controller)
- src/commands.py: save_all() uses app.save_config()

Test changes (route through controller, not I/O primitive):
- tests/conftest.py: mock_app and app_instance fixtures now patch
  AppController.load_config/save_config instead of models I/O primitives
- 18 other test files: patches renamed from models._save_config_to_disk
  to AppController.save_config (and same for load_config)
- tests/test_app_controller_mcp.py: use SLOP_CONFIG env var instead of
  patching removed CONFIG_PATH module constant
- tests/test_parallel_execution.py: pass max_workers=2 explicitly to
  ConductorEngine (caller no longer reads config)
- tests/test_gui_paths.py: add save_config=MagicMock() to MockApp;
  assert on controller method, not I/O primitive
- tests/test_models_no_top_level_tomli_w.py: still calls private
  _save_config_to_disk directly (the only allowed exception; tests
  the lazy-load behavior of the primitive itself)

New files:
- scripts/audit_no_models_config_io.py: enforces the rule (--strict,
  --json modes; AST-based docstring detection to avoid false positives)
- conductor/code_styleguides/config_state_owner.md: documents the rule

Verification:
- 67 targeted tests pass
- scripts/audit_no_models_config_io.py --strict returns 0

This is the architectural cleanup that surfaced during the
audit_architectural_cheats_20260607 review. Closes the smoke-gun
CONFIG_PATH module constant (already done in 0c7ebf22) AND the
free-function models.load_config/save_config smell.

[conductor(checkpoint): config-iO-refactor-20260607]

src/external_editor.py

@@ -7,7 +7,7 @@ import tempfile
 
 # TODO(Ed): Eliminate these?
 from pathlib import Path
-from typing  import Optional, List
+from typing  import Optional, List, Dict, Any
 
 from src.models import ExternalEditorConfig, TextEditorConfig
 
@@ -113,14 +113,16 @@ def auto_detect_vscode() -> Optional[TextEditorConfig]:
  return _cached_vscode_config
 
 
-def get_default_launcher() -> ExternalEditorLauncher:
+def get_default_launcher(config: Optional[Dict[str, Any]] = None) -> ExternalEditorLauncher:
  """
+ Caller passes the live config dict (typically app.config from the
+ AppController). Direct file I/O (the legacy public functions on src.models) is an
+ architectural smell (bypasses the controller state owner) and is
+ forbidden by scripts/audit_no_models_config_io.py.
  [C: src/gui_2.py:App._open_patch_in_external_editor, src/gui_2.py:App._render_external_editor_panel]
  """
- from src import models
- config = models.load_config()
- editors_config = config.get("tools", {}).get("text_editors", {})
- default_editor = config.get("tools", {}).get("default_editor", {}).get("default_editor")
+ editors_config = config.get("tools", {}).get("text_editors", {}) if config else {}
+ default_editor = config.get("tools", {}).get("default_editor", {}).get("default_editor") if config else None
  ext_config = ExternalEditorConfig.from_dict({
   "editors":        editors_config,
   "default_editor": default_editor,