Thread explicit `--config <path>` into `auto_fixable` computation on `add-to-config` actions

[BartWaardenburg]

Follow-up to #330 (merged in #366).

Symptom

After #366 the auto_fixable flag on add-to-config actions for duplicate-export findings is computed via FallowConfig::find_config_path(root).is_some() (see crates/cli/src/report/json.rs:89,303). That walks UP from root and returns the first config in the project tree.

The lookup does not consult an explicit --config <path> the caller passed on the CLI. So when the user runs:

fallow dead-code --root . --config /tmp/external.json --format json

and there is NO .fallowrc.* / fallow.toml anywhere in root's ancestor chain, the analysis emits auto_fixable: false even though the user has a perfectly usable config supplied explicitly. An agent gating on auto_fixable: true before invoking fallow fix --config /tmp/external.json --yes will skip the fix that would have succeeded.

Why this didn't ship in #330

Fix surface is small (4 production call sites in audit.rs, combined.rs, programmatic.rs, print_json) but the blast radius hits ~30 in-file test call sites of build_json because the cleanest signature change adds an Option<&Path> parameter. The bug surface is also narrow: requires --config pointing outside the project's ancestor chain AND an agent that gates on auto_fixable rather than just attempting the fix.

Suggested fix

Two options, roughly equal cost:

1. Add source_path: Option<PathBuf> to ResolvedConfig (set by load_config_for_analysis in crates/cli/src/runtime_support.rs) and consult it inside build_json / print_grouped_json. Cleanest architecturally; touches the config struct and one runtime-support function.
2. New 4-arg variant build_json_with_config(..., explicit_config: Option<&Path>), keep build_json as a 3-arg wrapper for backward compat. No struct change, but two public functions.

Either way the config_fixable computation becomes:

let config_fixable = explicit_config.is_some_and(Path::exists)
    || FallowConfig::find_config_path(root).is_some();

Acceptance

• auto_fixable reflects an explicit --config <path> when the supplied path exists, even if find_config_path(root) would return None.
• Unit test: build_json on a root with no ancestor config, passing Some(&existing_external_config) → auto_fixable: true on the duplicate-export action.
• Unit test: same setup with None or a non-existent explicit path → auto_fixable: false.

Out of scope

• Threading the explicit path into health / dupes / audit action builders (they don't currently emit add-to-config for config-writable issue types).
• Auto-discovery of package.json#fallow (intentionally not supported per Auto-fixable add-to-config writer for ignoreExports (follow-up to #322) #330).

[BartWaardenburg]

Released in v2.74.0.