X_CONFIG_IMPORT_OUTSIDE_LOADER
Means
a file other than packages/cli/src/app-config-load.ts imports an app's app.config.ts
Typical cause
a second reader of the config module, with its own defaults and trust policy, beside the one loader
Fix
read the section off loadAppConfig(root) from app-config-load.ts; a tier-forced exemption is a row in CONFIG_IMPORT_EXEMPT (scripts/lib/config-import.ts) with its reason