[SandObserver]

Summary

• Split the file read, parse and shape check out of loadConfig into _readDisk.
• Call _readDisk at the start of saveConfig instead of trusting the in-memory damage flag, so a file broken inside the 5 s cache window is backed up and refused.
• Make loadConfigForUpdate bypass the cache, and use it for the stale-write check in POST /api/config, so read-modify-write paths keep a hand edit.

Testing
All green. Added 2 tests: a file broken after the last read survives the next save with a backup, and a hand edit survives a read-modify-write.

Changelog

Fixed

• Keep a config file edited by hand while the container runs instead of overwriting it on the next save.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.