chore(setup): track config.php directly, slim README to setup checklist

config/config.php was gitignored and devs had to copy it from
config/config.php.example on every fresh clone. Since the bootstrap
config reads everything from .env via $envString() / $envInt() /
$envBool() defaults, there is nothing developer-specific in the file —
the cp step was dead ceremony.

- Remove config/config.php from .gitignore and track it directly
- Delete config/config.php.example
- Drop the example-existence + per-doc reference checks from
  bin/docs-drift-check.sh; add a legacy-pattern check that flags
  any new mention of the removed example file
- Update ConfigContractsTest to require config.php and forbid the
  example
- Clean stale references in CLAUDE.md, README.md, six docs files,
  and the core-guardrails skill

Same commit slims README down from 294 to 47 lines: one setup
checklist (now 3 commands instead of 4), the seeded login table,
the three quality-gate commands, and pointers to CLAUDE.md and
docs/index.md for everything else.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -26,7 +26,6 @@ Full workflow definition: `.agents/workflow.md` | Guard catalog: `.agents/checks
 
 ```bash
 # Start dev environment
-cp config/config.php.example config/config.php
 docker compose up --build -d
 # App: http://localhost:8080 | phpMyAdmin: http://localhost:8081
 
@@ -251,5 +250,5 @@ Additional non-blocking gates: QG-004 structural checks, QG-005 JS smoke, QG-007
 ## Environment
 
 - Config via `.env` (gitignored) — copy from `.env.example` for dev, `.env.prod.example` for prod
-- `config/config.php` (gitignored) — copy from `config/config.php.example`
+- `config/config.php` is tracked; all environment-specific values come from `.env` via `$envString()` defaults — edit only when adding new bootstrap settings
 - `APP_CRYPTO_KEY` (64-char hex) needed for AES-256-GCM encryption of SSO secrets