fix: restrict config-safe commands, add doctor header on config failure

Only config edit, config init, config path, and doctor run with a
broken config. Destructive commands like config set (which would
overwrite a partially-valid file with defaults) are now blocked.
Suppresses the warning on safe commands. Adds "Running pda! doctor"
header before diagnostic output.

cmd/root.go

@@ -40,10 +40,10 @@ var rootCmd = &cobra.Command{
 func Execute() {
 	if configErr != nil {
 		cmd, _, _ := rootCmd.Find(os.Args[1:])
-		if configSafeCmd(cmd) {
+		if !configSafeCmd(cmd) {
-			warnf("config error: %v (using defaults)", configErr)
-		} else {
 			printError(fmt.Errorf("cannot load config: %v", configErr))
+			fmt.Fprintln(os.Stderr)
+			infof("Running pda! doctor")
 			runDoctor(os.Stderr)
 			os.Exit(1)
 		}
@@ -56,13 +56,10 @@ func Execute() {
 }
 
 // configSafeCmd reports whether cmd can run with a broken config.
+// Only non-destructive commands that don't depend on parsed config values.
 func configSafeCmd(cmd *cobra.Command) bool {
-	for c := cmd; c != nil; c = c.Parent() {
+	return cmd == configEditCmd || cmd == configInitCmd ||
-		if c == configCmd || c == doctorCmd {
+		cmd == configPathCmd || cmd == doctorCmd
-			return true
-		}
-	}
-	return false
 }
 
 func init() {