Add --config file for taint source/sink/sanitizer sets

[bamdadd]

Context

The taint detector's source / sink / sanitizer keyword sets and min_segment_len are captured in TaintConfig (src/taintline/detectors/taint.py:79-84), but the CLI has no way to override them — a user is stuck with the built-in defaults. Real deployments have domain-specific tool names (e.g. charge_card, internal_fetch), so a config file is the top ask for making the gate usable outside the demo.

Needs a small design decision (file format, merge-vs-replace semantics, how it threads through run_all), so this is help wanted rather than a good first issue.

What to do

• Add a --config PATH option to taintline check pointing at a JSON/TOML file that supplies sources, sinks, sanitizers, and min_segment_len.
• Decide and document merge-vs-replace against the defaults (recommend: replace if a key is present, else default).
• Thread the parsed TaintConfig from the CLI into the taint detector without breaking the pure/deterministic check core (no I/O below the CLI boundary).
• Keep the zero-network, deterministic guarantees intact.

Acceptance criteria

• taintline check trace.json --config my.json --fail-on taint uses the file's sets.
• Absent --config, behavior is byte-identical to today.
• A test loads a config that adds a custom sink and asserts a finding that the defaults would miss (and vice-versa).
• Determinism tests still pass.

Pointers

• src/taintline/detectors/taint.py:79-84 — TaintConfig
• src/taintline/cli.py:41-59 — arg parsing / run_check; note run_all currently constructs detectors with defaults
• src/taintline/detectors/__init__.py:21-29 — where detectors are instantiated (TaintDetector())
• README "Determinism + zero-LLM check path" — the guarantee to preserve