fix: address Cubic round 5 issues — prototype-pollution guard, URL-encode, JSONC preservation, config-context warning, dynamic config path

src/cli/config-manager/config-context.ts

@@ -19,6 +19,9 @@ export function initConfigContext(binary: OpenCodeBinaryType, version: string |
 
 export function getConfigContext(): ConfigContext {
   if (!configContext) {
+    if (process.env.NODE_ENV !== "production") {
+      console.warn("[config-context] getConfigContext() called before initConfigContext(); defaulting to CLI paths.")
+    }
     const paths = getOpenCodeConfigPaths({ binary: "opencode", version: null })
     configContext = { binary: "opencode", version: null, paths }
   }