feat(config): 统一配置加载入口，启动时校验所有YAML配置

将分散的 config.yml、workflow.yaml、sandbox.yaml 加载逻辑统一到 AppConfig 模型，
启动时一次性校验，失败则 fast-fail。sandbox.py 改为从统一配置取值，消除重复加载。
同时修复 onebot 测试并新增14个统一配置测试（总测试 285→300）。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/unit/test_config_loader.py

@@ -8,13 +8,15 @@ import pytest
 
 @pytest.fixture(autouse=True)
 def isolated_yaml(tmp_path, monkeypatch):
-    """每个用例用独立的临时 yaml，避免污染真实 config/workflow.yaml。"""
+    """每个用例用独立的临时目录作为 config 目录，避免污染真实配置文件。"""
     from kilostar.utils import config_loader
 
-    fake_yaml = tmp_path / "workflow.yaml"
-    monkeypatch.setattr(config_loader, "_WORKFLOW_YAML", fake_yaml)
-    monkeypatch.setattr(config_loader, "_current", None)
-    return fake_yaml
+    monkeypatch.setattr(config_loader, "_CONFIG_DIR", tmp_path)
+    monkeypatch.setattr(config_loader, "_WORKFLOW_YAML", tmp_path / "workflow.yaml")
+    monkeypatch.setattr(config_loader, "_CONFIG_YML", tmp_path / "config.yml")
+    monkeypatch.setattr(config_loader, "_SANDBOX_YAML", tmp_path / "sandbox.yaml")
+    monkeypatch.setattr(config_loader, "_app_current", None)
+    return tmp_path / "workflow.yaml"
 
 
 def test_get_workflow_config_returns_default_when_file_absent():