Ben 4f9e15df97 feat(managed-scope): guard writes to managed config/env keys ...

- set_config_value hard-rejects a managed config key (D2) and names the
  source, exiting non-zero.
- save_env_value / remove_env_value refuse a managed env key.
- save_config strips managed leaves from a bulk write (mechanical safety net)
  with a warning, so the unmanaged remainder still persists.
New _strip_dotted_keys helper drives the bulk-save pruning. All guards are
distinct from and layered after the existing is_managed() package-manager
write-lock.

2026-06-19 07:46:33 -07:00

3.8 KiB

Raw Blame History

View Raw