feat(config): trigger the config.toml migration at startup

[LorrisSaintGenez]

What

Step 1 of GROUT-363 — wires the one-time config.toml → state.toml + keychain migration trigger, without the migration body yet.

• Config.ShouldMigrate(): true when config.toml exists and state.toml doesn't. state.toml is only written when the migration (or any new-model write) succeeds, so its absence doubles as the "not migrated yet" marker — an aborted migration naturally retries on the next run, no separate flag needed.
• Config.Migrate(): deliberate no-op for now — it must NOT write state.toml, otherwise the trigger would stop firing before the real migration ships. The body lands in the follow-up PRs (per-profile move, skip rules, atomicity).
• Call site in Execute(), right after InitConfig(): the migration has to run before the command executes because credential resolution reads state.toml once per invocation and caches it. A migration failure never blocks the command (logged in debug mode only).

Test

Unit tests only — Migrate is still a no-op, so there is no observable CLI behavior yet:

go test ./pkg/config -run TestConfig_ShouldMigrate -v

GROUT-363

[codacy-production]

Not up to standards ⛔

_{TIP This summary will be updated as you push new changes.}