Unify one-shot and state-aware config parsing

Nobody has claimed this yet.

### Description of the task

Reduce the divergence between the **one-shot** and **state-aware** config-parsing paths, ideally by building one-shot as a thin layer on top of state-aware so there is a **single canonical parse/validation path** whose semantics cannot drift.

Today the two paths are separate deserialization sites in `src/core/wxc_common/src/config_parser.rs`:

- **One-shot**: deserializes `experimental` into the typed `wire::Experimental`.
- **State-aware**: *peels* `experimental` off into an untyped `serde_json::Value`, masks it out of the typed deserialize, then re-types it **per-backend at dispatch time** (`config_deserialize::from_value`).

Because they diverge, `config_parser.rs` carries several **hand-mirrored checks** to keep the two consistent and avoid the "silent policy drop" class of bug, e.g.:

- rejecting moved-to-stable `experimental.seatbelt` / `macos_sandbox` in *both* paths separately;
- separately re-validating that `experimental` is an object on the state-aware path (the typed path gets this for free);
- separately typing `experimental.telemetry` on the state-aware path.

Each of these is a place the two paths can silently drift. Collapsing to one canonical path (one-shot as a degenerate/single-phase case of state-aware, or both delegating to a shared typed parse) would remove the mirrored checks and guarantee identical semantics.

### Additional context

- This came up while deciding where to apply `deny_unknown_fields` for the new `tamperProtection` policy: the dual-site design means restricting only one path would let a typo hard-error on one path and silently drop on the other — the exact inconsistency the mirrored checks fight.
- Grep `config_parser.rs` for "silent" / "silently discarding" / "same silent-policy-drop class" to see the current hand-mirrored guards.
- Scope note: this is a refactor of the Rust parsing layer (`wxc_common`); it should be behavior-preserving and covered by the existing one-shot + state-aware parser tests.