Summary

A check-up of the global config file management (~/.config/cagent/config.yaml)
surfaced one crash and several silent data-loss paths in the load/save cycle.
Every issue found is fixed here.

Issues and fixes

Write path after the change

writer (CLI command, TUI toggle, board)
  └─ userconfig.Update(mutate)
       ├─ flock config.yaml.lock        (cross-process serialization)
       ├─ Load()                        (freshest on-disk state + comments)
       ├─ mutate(cfg)                   (error aborts, file untouched)
       └─ Save()                        (atomic write, comments and unknown keys preserved)

The board now refreshes its cached config from disk on every save instead of
rewriting a snapshot held since startup, so changes made by other processes to
non-board sections survive a board session.

Behavior notes

• sandbox deny of an absent host no longer rewrites the config file.
• Read-only paths (Get, alias resolution, completion) take no lock: the
  atomic write already guarantees a consistent view.
• If the lock cannot be acquired within 5s, the update proceeds unlocked and
  logs a warning, matching the previous behavior rather than failing the save.

Tests

• Malformed config: Get() returns safe defaults, no panic
• Comments, unknown keys (both levels), and hooks survive a load/save cycle
• Clearing a commented section still saves
• 8 concurrent Update writers lose no changes (also run with -race)
• Mutate error leaves the file byte-identical
• Invalid global hooks never reach the runtime; valid ones pass through
• Unknown config version still loads
• doctor reports an unparseable user config and exits non-zero

Pre-existing SSRF/network test failures (TestURLSource_Read_RejectsLocalAddresses,
TestNewSSRFSafeTransport_RefusesPrivateIP, ...) are unrelated: they fail
identically on a clean tree in this environment because a local proxy
intercepts the requests those tests expect to be refused.