fix(cli): use XDG config paths consistently

[SequeI]

Linked Issue

Closes #1175

Summary

Route user config (config.toml, trusted-keys cache) through resolve_user_config_dir() instead of dirs::config_dir(), so macOS matches ~/.config/nono like profiles and packages already did.

Add $NONO_CONFIG profile expansion, display path helpers for CLI output, and update schema/docs/scripts to prefer XDG variables in machine-readable paths while keeping ~/.config/nono in user-facing docs and --help.

tldr: user facing docs = use absolute path just so mac users aren't lost. For inside code files, use XDG since it is expanded/replaced by defaults internally anyway is set/unset on both platforms. With this, we will be fully unified on the XDG spec

Test Plan

Checklist

• An issue exists and is linked above
• All commits are signed-off, using DCO
• All new code follows the project's coding standards (CLAUDE.md) and is covered by tests
• Public-facing changes are paired with documentation updates
• Release note has been added to CHANGELOG.md if needed

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+228
Lines removed	-55
Total changed	283
Classification	Medium (50–300 lines)

Affected crates

• crates/nono-cli — CLI changes. Verify argument parsing, flag documentation, and UX behaviour across supported platforms.

Blast radius — Broad

This PR touches: source code,documentation,configuration / policy files

---

_{Updated automatically on each push to this PR.}

[gemini-code-assist]

Code Review

This pull request standardizes configuration and profile path resolution across the codebase to use $XDG_CONFIG_HOME/nono (defaulting to ~/.config/nono) and introduces the $NONO_CONFIG variable for path expansion. It updates CLI output helpers, documentation, helper scripts, and integration tests to support this change. Feedback on the documentation changes highlights that replacing $HOME with ~ in file:// URIs will prevent proper shell expansion and fail runtime validation, so those instances should be reverted to $HOME.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.