fix(settings): serialize read-merge-write updates

[chioarub]

Summary

• serialize the complete settings read-merge-write transaction with the existing synchronous lock contract
• canonicalize symlink aliases to one physical target, recover stale/ownerless claims conservatively, and guard PID reuse without changing settings precedence
• apply one committed-write policy across stateful settings callers: reject in-memory/UI advancement when written is false, while retaining bytes that landed before a release error
• propagate contention through settings sync, permission, sandbox, plugin, provider, model, effort, theme, and configuration paths, and refresh symlink watcher targets safely
• reviewed CONTRIBUTING.md and AGENTS.md

Impact

• user-facing impact: concurrent OpenClaude processes no longer silently discard unrelated settings updates, and rejected writes no longer leave the current session showing state that was not persisted
• developer/maintainer impact: the public settings update contract remains synchronous, with no new dependency or settings-precedence change
• risk surfaces reviewed: config-home and symlink targets, lock ownership/recovery and contention, file permissions, startup/provider overrides, plugin/settings sync, permission rules, sandbox settings, and persisted terminal UI controls
• policy effect: no permission, sandbox, provider, routing, or startup default is broadened; failures remain visible and fail closed at persisted-state boundaries

Testing

• bun run check — completed successfully; the first pass reproduced the existing order-dependent src/utils/context.test.ts 8,000-token contamination and the built-in unattended retry cleared it
• bun run typecheck
• bun run typecheck:type-tests
• focused transaction, caller, UI, watcher, provider, permission, and sandbox tests (91 pass, 0 fail across 11 files)
• bun run test:provider (1,509 pass, 0 fail across 68 files)
• focused behavioral regressions were also checked against the prior PR head and failed on the missing behavior
• bun run security:pr-scan
• git diff --check upstream/main...HEAD

Notes

• provider/model path tested: provider startup override precedence plus real ModelPicker model-selection and effort interactions for rejected writes and committed writes with cleanup errors
• screenshots attached (if UI changed): pending; Config and sandbox failure-state copy changed and still needs maintainer-facing visual evidence
• follow-up work or known limitations: the PR has no linked issue or separate scope-approval reference; maintainers should treat that process decision and the pending screenshots as outstanding
• reviewer focus: committed-write behavior at stateful callers, physical-target lock identity/recovery, minimal key-owned patches during fresh read/merge/write, and symlink watcher retargeting
• hosted Node 22, Node 24, typecheck, web, and launcher checks pass on the amended head; the automated review check is still queued

Summary by CodeRabbit

• New Features

  • Settings synchronization now reports completion, partial application, failure details, and updated sources.
  • Concurrent settings changes are coordinated safely with per-source notifications.
  • Save failures now appear in dialogs and command responses.
  • Model, Fast Mode, permissions, plugins, marketplaces, and provider profiles support safer rollback and retry behavior.

• Bug Fixes

  • Improved handling of stale locks, symlink changes, interrupted writes, and malformed settings.
  • Prevents plugin installation or reload when required settings fail to apply.
  • Rejects unsafe plugin paths and preserves configuration during failed updates.
  • Permission and sandbox approvals now fail safely when persistence or delivery fails.