feat(explain): implement ATLAS-WP-0004 T01+T02 — effective-config resolver + config explain

Activate WP-0003 and WP-0004. Add tools/effective_config.py (deterministic,
order-independent override-path resolver — path only, never a value) and
tools/config_explain.py + `make explain` to render the layer path, winning
layer, validator, owner, consumers, and secret references for any surface.*.
Verified on all 4 seeded surfaces; order-independent; no values/secrets leak.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/rules/stack-and-commands.md

@@ -20,6 +20,9 @@ python3 tools/validate_registry.py  # schema + index consistency only
 git diff --check                    # whitespace / conflict markers
 reuse-surface validate --root .     # capability federation (from reuse-surface checkout)
 
+# Explain a surface's effective-config override path (no values shown)
+make explain SURFACE=surface.infotech.state-hub.api-config
+
 # After workplan or registry edits — from ~/state-hub
 make fix-consistency REPO=config-atlas
 ```