Fix config load error reporting and modernize the zod schema

[johncarmack1984]

First pass at the types/zod lane. Two independent commits.

The try in configFile wraps JSON.parse and the schema parse together and hands whatever comes out to fromZodError, which only accepts a ZodError. A trailing comma in config.json, or a packages.*.path that isn't there (the statSync inside packageConfigSchema's transform), reports this instead of the actual problem:

Invalid zodError param; expected instance of ZodError. Did you mean to use the "fromError" method instead?

fromError takes unknown, formats a ZodError identically, and passes anything else through with its own message. Three tests cover it: the JSON syntax error, the transform's ENOENT, and a schema violation to pin the zod formatting that was already correct.

Second commit is zod v4 object idioms — .passthrough() and z.string().url() are @deprecated in the installed 4.4.3, and .strict() reads as z.strictObject. No behavior change; parse results and inferred types checked against the previous schema before the swap.

Nothing here changes the config input shape, so it should stay clear of that question.

[github-actions]

Package Changes Through 74ba842

There are 1 changes which include @covector/files with patch

Planned Package Versions

The following package releases are the planned based on the context of changes in this pull request.

package	current	next
covector	0.13.0	0.13.1
@covector/apply	0.11.0	0.11.1
@covector/assemble	0.13.0	0.13.1
@covector/changelog	0.13.0	0.13.1
@covector/files	0.9.0	0.9.1
action	0.13.0	0.13.1

Add another change file through the GitHub UI by following this link.

---

Read about change files or the docs at github.com/jbolda/covector