config + docs/PHASE9: template comment + status -> Implement (Phase 9 commit #4)

config.lua header gains a Phase 9 paragraph documenting the
project-overlay feature + the R7 shallow-merge warning ("if your
.aish.lua sets a top-level block, it REPLACES the user's entire
block — list every entry OR omit the block"). Inspect at runtime
via `:config show`.

docs/PHASE9.md status header bumped: "Plan + review fold-in" ->
"Implement". Lists the 4 implement commits inline:
  e525063  history: trust file helpers
  34b465d  main: project-overlay loader
  5b6ee55  repl: :config show meta + HELP
  this     config template comment + status bump

Phase 9 implementation complete. Next inner-loop step: verify
(file TCs, run autonomous, close) + memory-update.

Regression: test_safety 87/87, test_router_model 31/31, repl loads.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

config.lua

@@ -6,6 +6,16 @@
 -- model-aware routing server-side (local models on boltzmann; cloud routes
 -- through OpenRouter using its own bearer auth — no client-side key here).
 -- Discovery: GET http://hossenfelder.fritz.box:8082/v1/models.
+--
+-- Phase 9 (docs/PHASE9.md): a `.aish.lua` in/above your cwd (walking up
+-- to $HOME) overlays this user config. First encounter prompts to trust;
+-- sha256-pinned in ~/.aish/trusted-projects. Use it for repo-specific
+-- model presets, permissions, hooks, etc.
+--
+-- IMPORTANT: shallow merge. If your `.aish.lua` sets a top-level block
+-- (models, permissions, cost, shell, ...), it REPLACES the user's
+-- entire block — list every entry you want available OR omit the block
+-- to keep the user's. Inspect the merge via `:config show` at runtime.
 
 local HOSSENFELDER = "http://hossenfelder.fritz.box:8082"