refactor(config): dedup migrate idempotency checks, add shadow_sentinel step

[bug-ops]

Summary

• Convert ~40 hand-rolled TOML section-header idempotency checks across crates/zeph-config/src/migrate/*.rs (features.rs, memory.rs, mcp.rs, tools.rs, session.rs, serve.rs, infra.rs, llm.rs) to the shared section_header_present() helper, which correctly handles inline-commented headers, implicit subtable parents, and commented-out headers — closing correctness gaps in the raw substring/line checks each step previously hand-rolled.
• Five conversions changed observable idempotency-guard behavior (narrower, more correct header detection): migrate_goals_config, migrate_memory_graph_config (beam_search), migrate_egress_config, migrate_vigil_config, migrate_tools_compression_config — each now pinned by a regression test on the exact dotted-key/inline-table counterexample that previously suppressed injection by coincidence.
• Add migration step 81 (migrate_shadow_sentinel_config) and a matching commented [security.shadow_sentinel] block to config/default.toml, closing the gap where this opt-in security section (already fully implemented and wired through SecurityConfig) was undocumented in default.toml and had no migration path for existing configs, unlike every other [security.*] subsection.

Closes #5934
Closes #5933

Test plan

• cargo +nightly fmt --check clean
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings clean
• cargo nextest run --config-file .github/nextest.toml -p zeph-config — 768/768 passed (765 baseline + 3 new regression tests)
• RUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --workspace --features "desktop,ide,server,chat,pdf,scheduler" clean
• gitleaks protect --staged --no-banner --redact — 0 leaks
• Real end-to-end migrate-config CLI run against a copy of the shipped config/default.toml (full MIGRATIONS+ConfigMigrator pipeline) — confirmed idempotent, step 81 correctly absent from the pending list since the section is already present (commented)
• CHANGELOG.md updated under [Unreleased]
• .local/testing/playbooks/shadow-sentinel-migration-step-81.md and .local/testing/coverage-status.md updated