CLI commands for the config group: inspect the configuration surface.
config show (aliased as config list/ls) resolves each option against the
app credential store (for credentials), the live environment, and config.toml,
reporting the effective value and which source provided it, matching what
git config --list / aws configure list users expect. Adding --verbose/--all
folds in each option's description and where it can be set (the static catalog).
config get <key> does the same for a single option. config path prints the
on-disk config locations.
Secret-flagged options (API keys and other credentials) are never printed by
value — config show/config get report only whether they are set and from
which source, so the output is safe to paste into a bug report.
Help rendering for a bare config invocation is served by ui.show_config_help,
which does not import this module. The heavy manifest/runtime imports here are
function-local to the subcommands, so a bare config/config -h invocation
never pulls them onto the startup path (parse_args does import this module to
register the subparsers, but only its light top-level imports run then).
