Enforce config precedence contract

[aidankhogg]

Motivation

• Establish and document a clear, explicit precedence contract for configuration composition so callers and CLI behavior are predictable.
• Ensure nested mappings are deep-merged and that a last-writer-wins rule applies for conflicting fields across layers.
• Provide a stable validation entrypoint for already-composed raw spec data to separate composition concerns from validation.

Description

• Documented the precedence contract in netengine/config/loader.py and netengine/spec/loader.py docstrings to state: structured defaults < caller-provided defaults/base spec < environment/spec file < explicit overrides/CLI --set, with deep merges preserving sibling keys.
• Added a public validate_spec_data wrapper in netengine/spec/loader.py to validate composed raw spec dictionaries while keeping load_spec behavior for single-file validation.
• Left composition helpers (load_spec_with_composition, load_spec_with_environment, SpecConfig helpers) to explicitly merge with ConfigLoader.merge_configs following the documented precedence.
• Added unit tests in tests/test_config.py covering ConfigLoader.load_config precedence, merge_configs nested merging behavior, spec environment composition precedence, and a lightweight CLI path test using _load_spec_for_cli with --env plus --set to assert CLI overrides win last.

Testing

• Ran pytest -q tests/test_config.py and the file-level test suite passed (all tests in tests/test_config.py succeeded).
• Ran the full test suite with pytest -q which executed the project test matrix; the run produced 551 passed, 10 skipped, and 2 failing integration tests.
• The two failing integration tests are unrelated to these changes and are: tests/integration/test_e2e_bootstrap.py::TestFullMVPLifecycle::test_full_mvp_lifecycle (received HTTP 401 where 200 expected) and tests/integration/test_m8_operator_api.py::TestHealthRoute::test_health_does_not_leak_last_error_detail (health payload included last_error).

---

Codex Task