feat(boatstack): bind detached external config

[bigboateng]

Summary

• accept a validated external project configuration during detached attachment
• copy exact configuration bytes only into the detached control root and bind their SHA-256 to status and generated snapshots
• fail closed on source, generated configuration, or lock drift across detached resume and mutation paths

Boundary conformance

Boundary: external project config to detached controller state.
Control law: every detached resume or mutation requires the copied source config, binding digest, generated lock digest, and generated project hash to agree.
Authorized actor: explicit detached attach or forced reattach.
Failure behavior: report unverified status and refuse resume or mutation without partial state changes.

Tests cover valid attachment, invalid and repository-local inputs, symlink aliases, digest propagation, drift and restoration, forced reattachment, resume paths, mutation paths, and publication bypasses.

Verification

• go test -count=1 ./...
• go build ./...
• go vet ./...
• python3 -m unittest discover -s tests -p test_*.py
• Boatstack distribution projection check: 406 files
• release-note validation and preflight
• git diff --check

Release note: 2026-08-05-detached-external-config.md