KC-1457: Block Service Mode from ever accessing its own config records

[amangalampalli-ks]

Summary

Blocks Service Mode from ever reading, editing, resharing, or deleting its own two config records ("Commander Service Mode Config" and "Commander Service Mode Docker Config"), no matter which command or how it's used.

Changes

• Reject any Service Mode command whose arguments reference either config record by name or by ID.
• Hide both records from the vault data while a command runs, so they can't surface indirectly either.
• Applied to every command, not a specific list, so new commands added later are covered automatically.
• None of this affects normal Commander usage outside of Service Mode — it only applies to commands run through the Service Mode API.