Refactor logger persistence wrappers and document env expansion semantics

[Copilot]

Semantic clustering flagged low-effort cleanup opportunities: thin persistence wrappers in logger internals and potential confusion between two env-expansion paths with different failure semantics. This PR applies those targeted refactors without changing behavior.

• Logger internals: remove thin writeToFile indirection

  • In internal/logger/tools_logger.go, inlined writeToFile() into LogTools by calling writeJSON(tl.data, 0644) directly.
  • In internal/logger/observed_url_domains_logger.go, removed writeToFile() and inlined serialization + writeJSON(..., 0600) at write sites (init + changed-domain flush path).

• Env expansion docs: clarify intentional semantic split

  • In internal/envutil/expand_env_args.go, added a cross-reference note to internal/config/expand.go clarifying:
    • envutil expansion passes through missing env vars unchanged
    • config expansion fails on undefined ${VAR}

• Test alignment with refactor

  • Updated internal/logger/tools_logger_test.go to validate the same file-write success/error paths through writeJSON(...) directly after removing writeToFile().

// Before
return tl.writeToFile()

// After
return tl.writeJSON(tl.data, 0644)

• Fixes [refactor] Semantic Function Clustering Analysis — Refactoring Opportunities #10083