fix(cli): keep instance context during config validation - #14084

Fixes #14040

What

Editing any .kilo/command, .kilo/agent, or .kilo/mode markdown file through the agent appended a bogus validation error to the tool result:

ERROR: .../.kilo/command/foo.md
  Failed to parse frontmatter: No context found for instance

It was content-independent (fired even without frontmatter) and only for project markdown.

Root cause

ConfigValidation.check is a plain async helper invoked from the file tools via Effect.promise(() => ConfigValidation.check(filepath)). Tools resolve the project instance from the Effect fiber (InstanceState.context -> InstanceRef), not from async-local storage. capture() can only read the fiber reference synchronously, so the first await inside check (await existing()) dropped it. markdown() then called Instance.current unguarded, which threw LocalContext.NotFound("instance"), and the surrounding catch mislabelled it as a frontmatter parse error.

Change

Capture the instance synchronously at the top of check() and thread it through isConfig and markdown. Project markdown is skipped when there is genuinely no instance (it cannot be scoped); global/trusted config still validates. The untrusted-markdown fileScope used for source-read confinement is computed identically, so the #12168 guard is unchanged.

Testing evidence

• New regression test in test/kilocode/config-validation.test.ts drives the fiber-only context (the production tool path) and asserts the file validates. It reproduced the exact reported string before the fix and passes after.
• bun test ./test/kilocode/config-validation.test.ts -> 11 pass
• bun test ./test/tool/write.test.ts ./test/tool/edit.test.ts ./test/tool/apply_patch.test.ts -> 71 pass
• bun test ./test/config/markdown.test.ts ./test/kilocode/config-validation.test.ts -> 48 pass
• Security: test/config/config.test.ts exfiltration case passes; test/kilocode/config/variable.test.ts + config/markdown.test.ts -> 15 pass
• bun run typecheck (packages/opencode), bun run lint (0 errors), prettier, and the annotations checker are clean

Changeset included (patch).

Notes

Reproduced on macOS as well as the reported Windows environment, so this is not platform-specific.