[zcsizmadia]

WSL reads autoMemoryReclaim only as experimental.autoMemoryReclaim. skrog wsl-config apply wrote it under [wsl2], where WSL ignores it with Unknown key 'wsl2.autoMemoryReclaim', so wsl.auto-memory-reclaim has never had any effect.

Change

• internal/wslconfig: keys now carry their section (SectionOf), and autoMemoryReclaim goes under [experimental]. Get and All read from the section WSL uses, so wsl-config show and skrog top stop reporting the ignored line as in effect.
• Migration: when Skrog manages the key and a copy sits under [wsl2], Plan moves it, and the diff says why:

  - autoMemoryReclaim=gradual  (under [wsl2], where WSL ignores it)
  + autoMemoryReclaim=gradual  (under [experimental])
  

  If the key is unset in Skrog's config, the line is left alone, since "not ours to touch" still applies.
• wsl-config --json: pending changes gain section, plus moved_from when a line is moved. Both additions are additive.
• skrog top: the hint now names [experimental] and includes the wsl-config apply step it was missing.
• Docs: vm-sizing.md, memory.md, cli-json.md and CHANGELOG.

Verified

On a real machine (WSL 3.0.3, Windows 10 22H2), starting from the file the released 0.8.0 binary writes:

• Released binary: config set + wsl-config apply --yes writes the key under [wsl2]. After wsl --shutdown, WSL prints Unknown key 'wsl2.autoMemoryReclaim'.
• This branch's binary: wsl-config shows the move diff above, and apply --yes moves the line under [experimental]. A second wsl-config reports nothing pending.
• Cold start after the move: the wsl.exe call that booted the VM printed no Unknown key line.
  • That this was the booting call is confirmed by DNS Tunneling is not supported, which this machine prints on every cold start. The supervisor booted the VM first on three tries, and those outputs were empty and not counted.
• Control for "no warning": a misspelled key under [experimental] does produce Unknown key 'experimental.autoMemoryReclaimX', so WSL does validate that section.
• ~/.wslconfig and Skrog's config were restored afterwards. The file matches its backup byte for byte.

Negative control: with SectionOf reverted to always return wsl2, 6 tests in internal/wslconfig fail. That includes every new behaviour test: the key is written under [experimental], a [wsl2] copy isn't reported as effective, a stale copy is moved, and only the dead copy is removed when the live one is already right.

go test ./... passes. Locally, scripts/lint.ps1 fails only at govulncheck, on Go standard-library advisories fixed in go1.27.2; this machine has 1.27.1. CI installs the current stable Go.

Fixes #550