fix(config): make database override refusals actionable

[ohdearquant]

Summary

• return a stable invocation-level refusal envelope for conflicting concrete --db / KHIVE_DB overrides, with invocation.started: false, a machine-readable database_override_conflict code, and a non-zero process status
• retain and report the canonical path of the configuration file that declared the backend topology, and point operators to --config / KHIVE_CONFIG for a persistent alternate target while describing :memory: as ephemeral
• honor kkernel exec --config consistently for inline requests, ops files, pending-event drains, and daemon auto-spawn without opening the refused database or contaminating MCP protocol stdout

Validation

• cargo test --manifest-path crates/Cargo.toml -p kkernel --test db_override_refusal
• cargo test --manifest-path crates/Cargo.toml -p kkernel explicit_config_reaches_daemon_spawn_seam
• cargo test --manifest-path crates/Cargo.toml --workspace
• cargo check --manifest-path crates/Cargo.toml --workspace
• cargo clippy --manifest-path crates/Cargo.toml --workspace --all-targets -- -D warnings
• cargo fmt --manifest-path crates/Cargo.toml --all -- --check
• RUSTDOCFLAGS=-Dwarnings cargo doc --manifest-path crates/Cargo.toml --workspace --no-deps

Closes #1386.
Closes #1586.

AI-assisted contribution: Codex prepared this change and PR description.