docs(config): document hierarchical config discovery

Update the README quick-overview bullet and the dedicated File Locations
section in docs/reference/configuration.md to describe the walk-up
behaviour added in #417: configs under `.opencode/` are discovered by
walking from the working directory up to $HOME, with closer configs
winning.

Includes a hierarchical example (`~/.config/opencode/` global,
`~/work/.opencode/` work overrides, repo-specific overrides under that)
and a security note explaining why `mcp_env_allowlist` remains
extensible only from the canonical user config.

README.md

@@ -336,7 +336,7 @@ Opinionated defaults, adjustable if you insist.
 See [Configuration Documentation](docs/reference/configuration.md).
 
 **Quick Overview:**
-- **Config Locations**: The compatibility layer recognizes both `oh-my-openagent.json[c]` and legacy `oh-my-opencode.json[c]` plugin config files. Existing installs still commonly use the legacy basename.
+- **Config Locations**: User config plus walked `.opencode/oh-my-openagent.json[c]` configs up to `$HOME`; closest wins. Legacy `oh-my-opencode.json[c]` still works.
 - **JSONC Support**: Comments and trailing commas supported
 - **Agents**: Override models, temperatures, prompts, and permissions for any agent
 - **Built-in Skills**: `playwright` (browser automation), `git-master` (atomic commits)