`massu config` CLI surface + drift detection runtime.

massu config CLI surface + drift detection runtime. Unblocks the config-migration workflow for downstream repos. Additive only — no breaking changes.

Added

• massu config <sub> — new top-level command tree dispatched from packages/core/src/cli.ts. Five subcommands:
• Session-start drift banner — packages/core/src/hooks/session-start.ts now emits a plain-text banner when config.detection.fingerprint disagrees with the current detected fingerprint. Silent on v1 configs (no stored fingerprint = no banner). Best-effort; never throws.
• detection.fingerprint auto-stamp — buildConfigFromDetection, config refresh, and config upgrade all stamp a deterministic SHA-256 stack fingerprint into the generated config.
• +35 tests covering refresh (config-refresh.test.ts, 11 cases), upgrade CLI (config-upgrade-cli.test.ts, 8 cases), check-drift (config-check-drift.test.ts, 5 cases), CLI dispatcher (cli-dispatcher.test.ts, 5 cases), session-start drift banner (session-start-drift.test.ts, 3 cases). Total suite: 1331 tests passing.

Changed

• Legacy CLI entry points (massu init, massu doctor, massu install-hooks, massu install-commands, massu validate-config) are preserved verbatim. massu config {validate,doctor} are aliases that route to the same handlers.
• Pattern scanner allowlist extended to include commands/config-{refresh,upgrade,check-drift}.ts — same rationale as existing init.ts/doctor.ts exemptions (raw YAML parse is required because getConfig() caches against process.cwd() and Zod-rejects pre-migration v1 configs).
• packages/core/dist/hooks/session-start.js bundle size: ~80KB → ~306KB (bundles fast-glob + smol-toml for runtime detection). Still compiles in <30ms via esbuild.

Fixed

• docs/plans/2026-04-19-autodetect-zero-config.md Phase 4 and Phase 5 are no longer deferred. The sibling plan docs/plans/2026-04-19-config-migration.md can now proceed.