fix(config): persist config set under an env token; fail on ephemeral overrides

[Martin Torp (mtorp)]

Problem

When a Socket API token was supplied via an environment variable
(SOCKET_CLI_API_TOKEN / SOCKET_SECURITY_API_TOKEN, or the legacy aliases),
the entire config was put into read-only mode. As a result,
socket config set <key> <value> silently failed to persist — yet still printed
a reassuring OK — and a later socket config get showed nothing, so it looked
like the value had been silently lost.

This is a common setup (keeping the token in an env var), and there's no good
reason that having a token in the environment should prevent saving an unrelated
key such as defaultOrg.

Fix

A token from the environment now overrides authentication only:

• getDefaultApiToken() already resolves the env token directly from the
  environment, so it is no longer mirrored into the persisted config cache and no
  longer flips the config to read-only. Unrelated keys (e.g. defaultOrg) are
  written to disk as expected via socket config set.
• The env-supplied token itself is still never persisted to disk.
• socket config get apiToken still reports the env token, which continues to
  take precedence over persisted / --config values.
• Updated the now-stale bootstrap comment in meow-with-subcommands.mts that
  still claimed the env token was injected into the cache and marked read-only.

When the config is genuinely ephemeral — fully overridden via --config,
SOCKET_CLI_CONFIG, or SOCKET_CLI_NO_API_TOKEN — socket config set now
fails with a clear error instead of pretending it succeeded. For a one-shot
command, an in-memory-only change is a no-op (nothing reads it before the process
exits), so failing is the honest outcome. (Note: under a full override,
config set --json now emits ok:false and exits 1, where it previously
reported ok:true.)

Testing

• pnpm check:tsc — clean. oxlint — clean on the changed config files (the
  constants.ENV import-style warnings in meow-with-subcommands.mts are
  pre-existing and unchanged by this PR).
• src/utils/config.test.mts — updated read-only message snapshot; added
  coverage asserting a token-env override is not read-only while --config
  and SOCKET_CLI_NO_API_TOKEN are.
• src/commands/config/cmd-config-set.test.mts — added: (1) a full --config
  override makes config set fail; (2) with only a token env var, config set defaultOrg persists to disk (verified by reading the written config file) and
  the env token is not written.
• Full config + login + logout suites pass (36 tests).

Bumps the CLI to 1.1.121 with a CHANGELOG entry.