fix(cli): preserve configurations when confirmed saves fail

[rudycelekli]

Summary

Save ifixai.yaml atomically by reusing the existing _write_report_atomic file writer. The setup wizard's confirmed save currently calls Path.write_text on the configuration itself, truncating an existing usable configuration before a write can fail.

Resolve the requested path before calling the atomic helper, so valid symlink chains remain links and their ultimate target is updated. Return the same requested config path. The existing helper stages in the target directory, preserves an existing file's mode, honors the umask for new files, and cleans an unsuccessful temporary write.

Native reproduction

An owned subprocess applies RLIMIT_FSIZE=128 and ignores SIGXFSZ inside that subprocess only. The actual writer raises OSError/EFBIG on a larger new configuration. On unchanged main, the prior 72-byte known-good configuration becomes a partial 128-byte file. After this fix, the same native failure leaves the prior bytes intact with no temporary file left behind. This does not fill a real disk or modify operator configuration.

Verification

• Unchanged current-main writer: 2 failed, 3 passed in new owner tests.
• Final owner tests plus existing CLI config-choice/judge-override and atomic-writer owners: 35 passed.
• Permission-bit assertions and the umask case are POSIX-only; functional success/load/return-path controls remain portable, and native-limit cases skip where resource is unavailable.
• Controls cover actual kernel failures for direct files and a two-link chain, successful replacement/retry, original return path, modes0600/0640 and new-file umask0077.
• ruff check ifixai (existing Ruff0.15.21), bandit -r ifixai -ll, and targeted advisory mypy: passed.
• ifixai validate:60 inspections valid; every one of11 example fixtures valid.

The production writer caller is the setup wizard's save confirmation. Local checks reuse the existing Python3.11 dependencies and invoke the actual writer and filesystem; no live/paid model call or manual interactive wizard session is claimed. The exact pushed commit passed all required fork CI jobs on Python3.10/3.11/3.12 (run37686800389). Upstream PR checks are not reported yet; its merge state is BLOCKED.