fix: publish config decode failures to the live issue list

A decode failure stops AppendSource before the issue list is rebuilt, so a
failed reload left Diagnostics showing the previous issues.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

service/internal/config/config_reloader.go

@@ -73,17 +73,25 @@ func unmarshalRoot(k *koanf.Koanf, cfg *Config) bool {
 	})
 
 	if err != nil {
-		configissues.ReportSticky(configissues.Issue{
-			Severity: configissues.SeverityError,
-			Code:     configissues.CodeConfigDecode,
-			Message:  fmt.Sprintf("Configuration could not be decoded: %v", err),
-		})
-		log.Errorf("Error unmarshalling config: %v", err)
+		reportDecodeFailure(err)
 		return false
 	}
 	return true
 }
 
+// A decode failure stops AppendSource before the issue list is rebuilt, so the
+// issue is published to the live list immediately as well as kept for later
+// rebuilds.
+func reportDecodeFailure(err error) {
+	issue := configissues.Issue{
+		Severity: configissues.SeverityError,
+		Code:     configissues.CodeConfigDecode,
+		Message:  fmt.Sprintf("Configuration could not be decoded: %v", err),
+	}
+	configissues.ReportSticky(issue)
+	configissues.Report(issue)
+}
+
 func afterLoadFinalize(cfg *Config, configPath string) {
 	metricConfigReloadedCount.Inc()
 	metricConfigActionCount.Set(float64(len(cfg.Actions)))

service/internal/config/load_failure_issues_test.go

@@ -58,6 +58,16 @@ func TestAppendSourceReportsDecodeFailure(t *testing.T) {
 	issue := findStickyIssue(configissues.CodeConfigDecode)
 	require.NotNil(t, issue)
 	assert.Equal(t, configissues.SeverityError, issue.Severity)
+	assert.True(t, hasLiveIssue(configissues.CodeConfigDecode), "decode failure should be visible without a rebuild")
+}
+
+func hasLiveIssue(code string) bool {
+	for _, issue := range configissues.List() {
+		if issue.Code == code {
+			return true
+		}
+	}
+	return false
 }
 
 func TestAppendSourceClearsLoadFailuresOnSuccessfulLoad(t *testing.T) {