Add snapshotted mapping configuration sources

docs/config.md

@@ -15,11 +15,18 @@ ConfigKit exposes opaque sources through these constructors:
 | `NewFilesystem(label, filesystem).File(name)` | Borrows a caller-owned `fs.FS` under a safe nonempty display label. `name` must be a non-root slash-relative `fs.ValidPath`. Each load reopens the selected regular file; copies of the `Filesystem` preserve namespace identity. Separate constructors create separate namespaces even for the same label or filesystem. |
 | `Bytes(label, data)` | Requires a nonempty, non-secret diagnostic label and snapshots bytes during construction. Later caller mutation cannot affect the source. |
 | `Reader(label, input)` | Requires a nonempty, non-secret label and non-nil reader. The reader is claimed once across all copies of the source, consumed but never closed, and cannot be reused. |
+| `Mapping(label, values)` | Requires a safe nonempty label and a non-nil root `map[string]any`. Snapshots supported built-in values into an owned mapping document at construction; `{}` is valid. Constructor conversion failures become safe deferred diagnostics. |
 | `NoSource()` | Selects defaults-only loading, creates no source record, and marks no paths explicit. |
 
 The zero `Source` is invalid. Constructor argument failures are retained inside the
 opaque source and become safe structured diagnostics when the source is consumed.
-File and filesystem sources can observe changes between consumptions; byte sources cannot.
+File and filesystem sources can observe changes between consumptions; byte and
+mapping sources cannot. Mapping accepts nil, built-in string, boolean, signed or
+unsigned integer, finite float, `[]any`, and `map[string]any` values recursively.
+Typed nil maps and slices represent explicit null; empty collections remain empty.
+Keys are sorted for stable provenance, integer decimal spelling stays exact, and
+cycles or unsupported types are rejected without exposing values. Mapping input
+uses the same directive and version rules as YAML, not CLI override restrictions.
 
 Each source is limited to 8 MiB. A load using imports or an active overlay is limited
 to 64 MiB across all accepted sources, 1,024 accepted sources, 64 active import
@@ -27,6 +34,8 @@ edges, and 1,000,000 input nodes in aggregate. Glob expansion separately permits
 1,000,000 visited directory entries, including nonmatches. Reads request at most the
 remaining allowance plus one byte so excess data is rejected rather than silently
 truncated. Data returned together with a read error is not accepted as partial input.
+For mapping sources, key and string bytes use the same accounting as programmatic
+overrides, and the converted tree uses the same node and depth bounds.
 
 ## Single-source loading
 
@@ -51,7 +60,7 @@ validate options → parse the selected source → traverse/compose enabled impo
   → snapshot configuration and metadata
 ```
 
-`File`, `Filesystem.File`, `Bytes`, and `Reader` each contribute the first base source with deterministic
+`File`, `Filesystem.File`, `Bytes`, `Reader`, and `Mapping` each contribute the first base source with deterministic
 ID `source-1`; enabled imports continue in depth-first order as `source-2` onward.
 `NoSource` skips parsing, supplies an absent version to a configured version checker,
 contributes no source, and continues through defaults, decode, and projection. A
@@ -68,7 +77,7 @@ disabled.
 Every source, options, schema, version, defaults, decode, resolution, or validation
 failure returns a nil result and a `*LoadError`. Successful results contain caller-owned `Config`, detached
 `Metadata`, a defensive source list, and defensive nonfatal diagnostics. Each source
-record's `Kind` identifies file, filesystem, bytes, reader, or CLI acquisition
+record's `Kind` identifies file, filesystem, bytes, reader, mapping, or CLI acquisition
 independently of its precedence `Layer`. Host file paths remain canonical;
 filesystem paths are slash-relative within their namespace; synthetic inputs have
 no path. Mutating
@@ -590,12 +599,12 @@ their contents are accumulated.
 
 For host files, the configuration root defaults to the selected file's canonical
 directory. A host file may supply `FilesystemContext.Root` to widen that root but
-may not supply `BaseDir` or a native `FS`. Byte and reader inputs with host context
+may not supply `BaseDir` or a native `FS`. Byte, reader, and mapping inputs with host context
 must provide both `BaseDir` and `Root` as absolute existing directories.
 For `Filesystem.File`, the default root is `.` in its namespace and the base is
 the selected file's directory. An explicit context must use the same `Filesystem`
 namespace and may set `Root` to contain the file and its base; it may not supply
-`BaseDir`. Byte and reader inputs with native context provide both `BaseDir` and
+`BaseDir`. Byte, reader, and mapping inputs with native context provide both `BaseDir` and
 `Root` as slash-relative `fs.ValidPath` directories in `FS` (`.` means its root),
 with the base inside the root. Context paths are checked even when imports and
 overlays are inactive. Diagnostic labels, including URI-looking labels, never