Summary

This fixes a config writeback bug where writeConfigFile(loadConfig()) could drop keys that were added on disk after the active runtime snapshot was created.

In practice that meant an explicit top-level session.dmScope could disappear during gateway-triggered writebacks, which matches the dmScope persistence bug reported in openclaw#15146.

Root cause

src/config/io.ts projected runtime-derived configs back onto runtimeConfigSourceSnapshot before persisting them.
When that source snapshot was stale, any newer disk-only keys were missing from the projection base, so the follow-up write deleted them.

This PR now:

• prefers the latest valid on-disk snapshot as the projection base for runtime writeback
• falls back to the last runtime source snapshot only when the current file cannot be read
• adds a regression test that reproduces session.dmScope being stripped by a stale runtime snapshot

Testing

• corepack pnpm vitest src/config/io.runtime-snapshot-write.test.ts
• corepack pnpm vitest src/config/io.owner-display-secret.test.ts
• corepack pnpm vitest src/config/env-preserve-io.test.ts

Fixes openclaw#15146.