Fix five CLI and validation bugs from issue triage (#494)

A batch of five verified fixes for reported bugs. Unknown top-level qm.config.jsonc fields are now rejected instead of silently ignored. publicUrl must be an origin URL on every target, and Slack OIDC is detected by hostname including a usesSlackOidc override. The postgres run-store's waitFor survives transient poll failures and clears its timeout. CLI dotenv parsing is aligned with Node's --env-file semantics across both parser copies. And the tool_calls primary-key migration is one-shot, transactional, and self-healing instead of rebuilding on every boot.  Achyuthan-S

**Deployment notes**

Re-add "modelProvider" to the top-level allowlist in the upstream PR (flagged in the diff
itself)
Release-note the validation tightening: unknown top-level config fields, non-origin publicUrl,
and quoted dotenv values now behave differently
Stricter CLI validation: unknown top-level qm.config.jsonc fields are now rejected — configs that
deployed fine before (typos, private extensions) fail the CLI after upgrade
The fork's VALID_TOP_LEVEL_KEYS allowlist deliberately omits "modelProvider", which public qm
reads — the in-diff NOTE says to re-add it when syncing; shipping upstream without it breaks
every upstream config that sets modelProvider
publicUrl validation tightened to origin-only: values with a path, query, fragment, credentials, or
trailing hostname dot that previously passed are now rejected
dotenv parsing now follows Node --env-file: quoted values are unquoted and \n expands inside
double quotes — an env file whose quoted value previously kept its literal quotes silently changes
value (e.g. a secret wrapped in quotes)
tool_calls PK migration becomes a single transactional, conditional DO block at boot: runs only
while the PK is the legacy shape, dedupes keyless duplicates keeping the newest, no-op
afterwards — fixes the old crash window that could leave the table without a PK; rollback safe
(final PK shape unchanged, old code's DROP+ADD is also idempotent against it)
waitFor poll now survives transient pg failures and clears its timeout — pure fix, no compat impact

<!-- codesmith:footer -->
---
<a href="https://app.blacksmith.sh/yc-software/codesmith/qm/pr/468"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v2.svg"><img alt="View with [code]smith" src="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"></picture></a> <a href="https://backend.blacksmith.sh/track/enable-autofix?expires=1789248767&installation_model_id=19911&pr_number=468&repository=yc-software%2Fqm&return_to=https%3A%2F%2Fgithub.com%2Fyc-software%2Fqm%2Fpull%2F468&signature=9ae8c5e260828f7c4dcb792665ec8cdf044c4322d738b7b79dff558f7ac24eba"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img alt="Autofix with [code]smith" src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"></picture></a>
<sup>Need help on this PR? Tag <code>@codesmith-bot</code> with what you need. Autofix is disabled.</sup>

<!-- codesmith:autofix:disabled -->
<!-- /codesmith:footer -->