fix(personas): persist pack-backed persona UI edits across reboot

[wpfleger96]

Problem

Pack-backed personas (source_team set) have their PersonaRecord fields overwritten on every app launch by sync_team_from_dir (teams.rs:502-509), which reads the source .persona.md and does an unconditional pack-wins overwrite. A UI edit saved via update_persona writes only to personas.json, so launch sync clobbers it on the next boot — the reported symptom was an edited model resetting to its old value after restart.

Fix

After update_persona saves to personas.json, if the persona has source_team set, write the edited fields back to the source .persona.md so launch sync becomes a no-op. The source file is resolved the same way launch sync resolves it — load_pack(source_dir) plus LoadedPersona.source_path — rather than by filename convention, so it works for both agents/ and personas/ pack layouts. The owning team is matched by team.id OR team_persona_key(team), covering legacy/backfilled teams whose TeamRecord.id is a UUID while source_team holds the manifest/directory id.

Six fields are written back:

• Frontmatter: display_name, runtime, avatar, and model (joined as provider:model per the pack format, bare when provider is absent — the inverse of split_model).
• Body: the persona prompt.

Prompt decomposition

PersonaRecord.system_prompt is the composed prompt — the raw body plus pack instructions appended by compose_prompt (resolve.rs:248-255):

{body}\n\n---\n# Team Instructions\n{pack_instructions}

Writing the composed string back to the file body would double-append the Team Instructions block on every launch. So write-back recovers the raw body by reversing compose_prompt:

1. If system_prompt == compose_prompt(current_body, instructions) → prompt unedited; body byte-preserved.
2. Else, with no pack instructions → body = system_prompt verbatim.
3. Else strip the exact \n\n---\n# Team Instructions\n{instructions} suffix to recover the new body.
4. Safety guard: if instructions are present but the exact suffix is absent (an edit shape that can't be cleanly decomposed), the body is preserved and a skip is logged — never a corrupted file or double-append.

Byte fidelity is preserved at both normalization boundaries so the decomposition's exact-suffix match holds: update_persona no longer trims system_prompt (instruction files commonly end in a trailing newline that the trim would strip), and PersonaDialog submits systemPrompt verbatim. The five other UI fields are still trimmed. create_persona storage is unchanged.

Implementation notes

• Frontmatter rewrite: split_frontmatter + serde_yaml::Value round-trip (same approach as rewrite_legacy_persona_md_runtime in migration.rs).
• Non-fatal: missing source_dir (JSON-only team), unmatched team, unreadable/missing file, unresolvable pack/persona, parse or write error → logged and swallowed. personas.json is already persisted, so the in-app edit lands regardless and update_persona never starts returning Err.
• In-app personas (source_team == None) → early return, no file I/O.

Tests

cargo test --lib (desktop): 845 passed, 0 failed. Coverage includes the joined provider:model key, bare model, runtime/avatar clear, unrelated-key preservation, body-not-replaced-by-composed-prompt, both pack layouts, legacy/modern team-key matching, and the prompt-decomposition paths — edited-with-instructions (including a trailing-newline instructions.md), edited-without-instructions, unedited round-trip, the safety guard, and a multi-save round-trip proving the == short-circuit holds across consecutive saves.