fix: prefer explicit local keys over saved bunker

[TheCryptoDonkey]

Summary

• treat the URI saved by bunker connect as a fallback only
• keep explicitly configured bunker URIs authoritative
• preserve local signing when an environment key, key file or ncryptsec source is supplied
• add config-source regression coverage and an end-to-end CLI check

Verification

• npm run lint
• npm run build
• npm test (92 files, 1,533 tests)
• focused config tests (31 tests)
• CLI tests (21 tests)