feat(cli): add GANDER_CONFIG profile selector for non-prod gandermd

[scott]

Summary

• configPath() now honors GANDER_CONFIG=<name> → reads and writes ~/.gander.<name> instead of ~/.gander. The two files are fully isolated — no field-level mutation, no WriteConfig workaround — so running the CLI against a local dev or staging gandermd never disturbs the prod profile.
• Profile names validated against path traversal (rejects ., .., /, \). Legacy ~/.mdp fallback still applies to the default profile only.
• Tests cover: env branch + isolation from primary, traversal rejection (4 subcases), and legacy .mdp bypass for named profiles.
• README, man page, AGENTS.md all updated with the new env var.

Paired with

gandermd/gandermd#37 — server-side make dev workflow that uses GANDER_CONFIG=dev via a bin/gander-local wrapper. Per gandermd/AGENTS.md ("CLI pairing"), ship in the same release cycle.

Local loop after merge

# terminal 1 (server repo)
make dev                                # provisions gandermd_dev DB, boots :7331

# terminal 2 (server repo, after make dev-cli)
./bin/gander-local signup --email dev@example.com
./bin/gander-local share README.md
./bin/gander-local list

Prod gander on $PATH keeps using ~/.gander. The wrapper only exists at bin/gander-local in the server repo. ~/.gander and ~/.gander.dev never interact.

Acceptance criteria

• GANDER_CONFIG=dev gander signup --email foo@bar.com creates ~/.gander.dev; ~/.gander is byte-identical before and after.
• GANDER_CONFIG=dev gander share README.md posts to localhost:7331 and persists share mapping into ~/.gander.dev.
• Without GANDER_CONFIG, behavior is identical to before — including the .mdp legacy fallback.
• Two concurrent profiles don't collide.
• GANDER_CONFIG=../escape errors out cleanly.

Closes #54.

[scott]

/oc please review this PR and approve if you find it ready to merge