Function load_config_from 

pub fn load_config_from(
    global_dir: Option<&Path>,
    project_root: &Path,
    trust: ProjectTrust,
) -> Result<LoadedConfig, ConfigError>

Load config with explicit paths (for testing).

With ProjectTrust::Untrusted, the repo file’s rule paths must stay inside project_root and its user-only keys ([ai], [git], [fix], scan.cache_dir) are dropped with a warning. The global file is always trusted.