Decide JS/TS config files: sandboxed support or explicit forever-JSON

[ColumbusLabs]

Summary

DebtLens prefers JSON config (no execute-on-load). Some users want debtlens.config.ts. Decide: sandboxed support vs permanent JSON-only with SchemaStore DX.

Acceptance criteria

• Written decision in docs (ADR/RFC)
• If supporting TS/JS: sandbox + security model + tests
• If rejecting: document alternatives (JSON + plugins + codegen)
• Update init/doctor messaging accordingly