fix: Let a flag beat the analyzer's persisted configuration

The session configuration was decoded straight through the pointers it
shares with the cobra layer, so it overwrote whatever the command line
had just put there. A value persisted months ago beat the flag typed a
second ago, silently, with no way to override it. This predates the
port; it was reported earlier in this work and left alone because
fixing it needs a fact the code did not have.

That fact is which values came from the command line. The flags bind
straight to the configuration singletons by pointer, so once a command
line has been parsed there is nothing left to distinguish a value the
user asked for from the default that happens to equal it.
config.SnapshotDefaults records the singletons at the one moment when
they are exactly the defaults: inside Execute, after every registration,
which all happen in package initialisers, and before cobra is handed the
arguments. A field that no longer holds its recorded default is one a
flag set.

With that, the order is the conventional one -- default, then persisted
configuration, then flag. The file is decoded into detached structs, so
a half-decoded corrupt file cannot leave the live configuration
half-applied either, and is then applied only to fields still holding
their defaults. The pointers are put back afterwards, because conf set
reflects over them and a detached set would send every change into a
copy nothing reads.

Two limits, both deliberate and documented. A flag passed with exactly
its default value looks unset, so the persisted value wins for that
field, which is the benign direction. And with no snapshot -- a test
rather than the tool -- every non-zero value is treated as deliberate
and the persisted settings only fill in what is still zero.

Reverting either half of the fix fails the tests: decoding through the
live pointers again, and applying the persisted values unconditionally.