feat(explain): implement ATLAS-WP-0004 T01+T02 — effective-config resolver + config explain

Activate WP-0003 and WP-0004. Add tools/effective_config.py (deterministic,
order-independent override-path resolver — path only, never a value) and
tools/config_explain.py + `make explain` to render the layer path, winning
layer, validator, owner, consumers, and secret references for any surface.*.
Verified on all 4 seeded surfaces; order-independent; no values/secrets leak.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

workplans/ATLAS-WP-0003-discovery-connectors.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Discovery connectors"
 domain: infotech
 repo: config-atlas
-status: ready
+status: active
 owner: codex
 topic_slug: custodian
 created: "2026-06-26"
-updated: "2026-06-26"
+updated: "2026-06-27"
 state_hub_workstream_id: "e4400d9c-021a-4e44-8e9b-719f94a9561a"
 ---