#23339: fix: use snapshot.parsed for env ref restoration during migrate

During config migrate, env var references like $TOKEN are being resolved to actual values and written to the config file. This fix uses snapshot.parsed (pre-substitution) instead of re-reading the file. <!-- greptile_comment --> <h3>Greptile Summary</h3> Fixed a bug where environment variable references like `${TOKEN}` were being resolved to actual values (e.g., `sk-ant-...`) when written back to the config file during migrations. The old code re-read the file from disk to get pre-substitution values, but during migrations the on-disk file may already be partially modified, causing the wrong baseline to be used. The fix uses `snapshot.parsed` (already loaded pre-substitution config) instead of re-reading from disk. - Changed from re-reading the config file with `fs.readFile` + `parseConfigJson5` to using the existing `snapshot.parsed` - `snapshot.parsed` is populated in `readConfigFileSnapshotInternal` at line 749 and contains the parsed JSON5 before `$include` resolution and `${ENV}` substitution - This ensures env var references are properly preserved even when the file is being modified mid-migration <h3>Confidence Score: 5/5</h3> - Safe to merge - straightforward fix that uses already-loaded data instead of re-reading from disk - The fix correctly addresses the issue by using `snapshot.parsed` which is already loaded and guaranteed to represent the pre-substitution config state. The change is minimal, well-documented in comments, and uses existing data structures. The logic is sound: during migrations, re-reading the file could pick up partial modifications, whereas `snapshot` was loaded at the start and represents a consistent state. - No files require special attention _{Last reviewed commit: bd7a96b} <!-- greptile_other_comments_section --> _{(2/5) Greptile learns from your feedback when you react with thumbs up/down!} <!-- /greptile_comment -->