24b33d42e0
The CLI's _write_config took only the best-effort file lock, so an in-process refresh thread could still interleave with a command's read-modify-write. The dashboard's Honcho save (_write_provider_honcho) still seeded its whole-file rewrite from a tolerant reader, so a honcho.json that exists but does not parse was replaced by the active host's block alone from the UI - the same bug class this PR closes on the CLI and refresh paths. `hermes profile create --clone` swallowed the new ConfigWriteRefused as "plugin not installed". One parametrized test covers the web writer for the corrupt and parseable cases.