feat(core): expose config changes stream - #39131

What

Adds config.changes() to the Config service: a stream of raw filesystem updates under config roots. This is the seam that lets domain owners (commands, agents, plugins) observe edits to the source files they parse — without overloading config.updated, which stays reserved for structured config and topology changes.

Second slice of the config source reload series, after #38983 (read-barrier event ordering). Design doc: docs/design/config-source-reload.md on the config-source-reload branch.

How

Config already owns everything this needs: reconcileWatches keeps deduplicated recursive subscriptions aligned with entries, and every Watcher.Update under every root already funnels into one internal PubSub (packages/core/src/config.ts). This PR exposes that existing feed:

readonly changes: () => Stream.Stream<Watcher.Update>

implemented as Stream.fromPubSub(updates) — one line of runtime code. Because Config reconciles watches on reload, subscribers also receive updates from roots added later, without resubscribing.

Consumers will compose filtering and debounce at the call site:

config.changes().pipe(
  Stream.filter(isCommandPath),
  Stream.debounce("100 millis"),
  Stream.runForEach(() => command.reload()),
)

The remaining diff is mechanical: 24 Config.Service.of test stubs across 16 files gain changes: () => Stream.empty.

Scope

Deliberately not here, coming as follow-up PRs:

• Command/agent/plugin source invalidation consuming this stream (Changes inside config directories do not trigger config-backed reloads #37429).
• Narrowing Config's own reload classification so descendant edits stop triggering full rediscovery.

Testing

• New test: Config > exposes filesystem updates under config roots through changes — written red first (config.changes is not a function), green after.
• bun test over all 13 touched test files: 102 pass, 0 fail.
• bun typecheck in packages/core: clean.
• test/session-runner.test.ts fails identically (24) with and without this change — the pre-existing Unbound layer node: @opencode/Location set from the tool consolidation refactor, unrelated to this PR.