[H-5 / Phase 2] [MEDIUM] Replace hand-rolled config validator with Zod

[matthewod11-stack]

Full spec: docs/hardening-roadmap-2026-04-16.md#h-5

Description

packages/core/src/config.ts:74-141 is ~70 lines of manual type assertions. Zod is already a dep in @sourcerer/ai, @sourcerer/intake, @sourcerer/scoring. Custom validator duplicates Zod, skips nested-field checks, produces weaker errors.

Current State

• validateConfig() and applyDefaults() in packages/core/src/config.ts.

Suggested Fix

• Add zod to packages/core/package.json deps.
• Define SourcererConfigSchema with z.infer producing existing SourcererConfig type.
• Replace validateConfig() body with SourcererConfigSchema.parse(raw) (keep signature + ConfigValidationError class; map ZodError → ConfigValidationError).
• Delete applyDefaults() — use Zod .default() inline.

Verification

• pnpm build passes
• pnpm test passes (existing config.test.ts unchanged)
• pnpm typecheck clean
• New test: missing required field → Zod-style path error (e.g., adapters.exa.apiKey: Required)
• validateConfig() < 20 lines

Automation Hints

scope: packages/core/package.json, packages/core/src/config.ts, packages/core/src/tests/config.test.ts
do-not-touch: other packages
approach: refactor-to-config
risk: low
max-files-changed: 3
blocked-by: none
bail-if: any downstream package fails to build

Priority

Medium