feat: I3097 P03 derive and persist hash debug inputs #3100

Parent feature epic: #3097. Phase P03, class design-bearing, owner ac-dev-rust-v5, dependency P02 (merged main required).

Situation and intended result

Derive readable original contributing strings beside both existing base and pair hashes; include configured variables without changing cid1, stable IDs or runtime behavior.

Approved specification and scope

Canonical D:/0_repos/AgentsCommander_iac/.ac/plans/3097-id-hash-debug/p03-v3-derived-persistence.md, SHA256 E6F255F765343B4B91C28B1FD5F6D275A088BB4A83E8EBF84F9A6FC36A48C7E9.
Parent plan-v3 SHA256 B86F5DC6F3813AF551FD1055953829DC0493936AD82EAE1BAF05DA8D1520351E; exact-set consensus in consensus-round3-v3.json.
Four files: src-tauri/src/config/settings.rs (production derivation/publication plus bounded tests), src-tauri/src/commands/config.rs, src-tauri/src/cli/coding_agent.rs, src-tauri/src/config/coding_agent_mutations.rs (existing test assertions only).
Original base command, all base env keys/values in vector order including disabled/empty/duplicates; then pair profile arguments and env keys/values in BTreeMap order. Derive from authoritative real inputs, never stale debug. Keep every existing hash/preimage function byte-identical. Mirror current physical/effective refresh and insert/remove ownership; retained groups and no-write reads preserved. No new save, lock, runtime env, shell parsing or logging.

Acceptance and verification

Arrays match independent raw input oracle, fixed hashes remain equal, and Unicode pair proof reproduces two-stage normalization independently. First-match, orphan, absent/empty, malformed/forged, physical/effective, retained groups, fixed-point saves, rejection/CAS and CLI/returned snapshots follow approved contracts.
Shipper: all-target check plus serial locked --lib filters id_hash, settings_draft_events, local_overlay_1737, source_identity_tests, issue_3047, profile_identity_2450, derived_agent_id_binding_projection, blocking_menus_1905, remote_blocking_menus_1925. Positive counts/green results; exact root/structural/CI gates in canonical phase. Child-only closure; no package/install/release/version.