Fail closed on diagnostic config and history reads

Diagnostics previously reused the recovery-oriented ConfigStore readers. A missing, unreadable, or corrupt primary config could therefore be replaced by cached, backup, or default data, leaving diagnostics without a trustworthy decrypted secret set. Dedicated history failures and invalid payloads could likewise become a healthy empty result or stale config history.

Add explicit diagnostic config and history reader contracts. The config path bypasses caches and recovery fallbacks, validates the primary document, decrypts its current credentials, and propagates read, parse, validation, and decryption failures. The history path accepts a valid empty array, rejects unreadable or malformed dedicated data, and uses strict legacy config history only when no dedicated file exists. Keep the normal UI recovery readers unchanged and wire diagnostics to the strict contracts.

Cover primary recovery isolation, decryption failure propagation, valid empty history, corrupt and unreadable history, stale-history fallback prevention, pre-migration compatibility, and main-process wiring. Existing collector tests continue to prove successful responses, response-boundary redaction, shared history semantics, and snapshot non-mutation.

main.js

@@ -3246,8 +3246,8 @@ function _diagAgentInfo() {
 
 function _buildDiagnosticHandler() {
   const collectors = createCollectors({
-    loadConfig: () => configStore.load(),
-    loadHistory: () => configStore.loadHistory(),
+    loadConfig: () => configStore.loadDiagnosticsConfig(),
+    loadHistory: () => configStore.loadDiagnosticsHistory(),
     getAllLogPaths,
     support: { sanitizeConfig, collectSecretValues, redactLogText, valueScrub, collectFile, REDACTED },
     stats,