[fix] Harden managed configuration writes

[travis-hoover-glean]

Host configuration writers currently treat every read or parse failure as a missing file. During a privileged scheduled run, malformed or unreadable JSON, TOML, or YAML can therefore be replaced from an empty document while losing existing access metadata.

Solution

• centralize managed-file locking, symlink resolution, and atomic replacement with unique temporary files
• only treat ENOENT as a new file; preserve malformed, unreadable, and non-object configuration unchanged
• preserve existing modes, ownership, and Windows ACLs, while creating new files with owner-only permissions
• route generated MCP/MDM config through the same safe writer and retain unknown schema fields
• reduce JSON, TOML, and YAML modules to codec adapters over one shared mutation policy

Test plan

• bunx tsc --noEmit --composite false --incremental false
• bunx vitest run (182 tests)
• Cross-platform CI, including Windows ACL and privileged config E2E