feat(handlers): dconf_set writes system policy via direct file IO (Phase 7)

[remyluslosius]

Phase 7 — the final handler port, completing the kernel-primitive migration. dconf_set now writes the system dconf policy files (profile, keyfile snippet, optional lock) via direct atomic file IO (fsatomic), instead of the shell printf + mkdir pipeline, in agent mode.

Two founder-ratified scope decisions baked in

• dconf is file writes, not D-Bus. The migration doc's "D-Bus to ca.desrt.dconf" is the user-session dconf API; dconf_set manages system policy, which is file-based (profiles/keyfiles/locks compiled by dconf update). The honest port is fsatomic file writes + dconf update shell compile — the file+compile pattern (same as mount's fstab+remount, audit's drop-in+augenrules).
• selinux_boolean_set stays on setsebool -P (left untouched): that one command does runtime+persist correctly; the selinuxfs split (/sys/fs/selinux + commit_pending_bools) would add untestable ABI risk for a marginal win — the same "don't reimplement the risky low-level op" call as the mount remount.

What

• kernelio: MkdirAll primitive added to the FileTransport capability (a drop-in dir must exist before an atomic write); local.Transport + FakeSysctlTransport implement it.
• dconf_set Apply/Capture/Rollback gain a kernel-IO branch via transport.(kernelio.FileTransport), falling back to the shell path. Apply writes the profile (create-if-absent — existing operator profile preserved), snippet, and lock atomically; both paths write byte-identical files, record an identical PreState shape, and run dconf update.
• spec kernelio-dconf (Tier 1, 3 ACs) + round-trip tests (writes+updates, keep-existing-profile, remove-when-absent, restore-when-existed, shell fallback).

Verification

go test ./... green; go build ./... clean; golangci-lint 0; comment-lint clean (checked post-commit); specter sync all pass.

Failure-mode analysis

1. Wrong in prod? Corrupting dconf policy. Mitigated: atomic writes (fsatomic temp+rename); profile is create-if-absent (operator profile never clobbered); snippet/lock are Kensa-owned drop-ins; dconf update compiles on both paths.
2. Captured-state sufficiency: rollback consumes file_path/prior_content/file_existed (same tuple on both paths) → restores or removes the snippet; read error → ErrCaptureIncomplete. (Capture tracks only the snippet, as before — unchanged scope.)
3. Edge case / gated: dconf update compile stays shell (the toolchain's job). ⚠️ LIVE validation needs a real dconf host; kensa-fuzz + two-human rollback review (CONTRIBUTING) are the founder's gate.

🤖 Generated with Claude Code