lembas remote: manage remote: without YAML; a running service follows it

`lembas remote list | add | remove | enable | disable | mode | terminal`, with
`--json` printing {enabled, roots, max_mode, terminal}, for LLeMbas Desktop.
Writes go through the global config writer and keep comments.

The device's limits are now live getters over the remote: block, re-read when
config.yaml's stat changes. `lembas service` links even with remote work off
or no roots: it says roots: [] and refuses every session, directory and
terminal, so the instance can tell "no folder allowed yet" from "not running".
When what the instance was told changes, the link re-dials once nothing is
working, so `lembas remote add` or `enable` takes effect without a restart.
Harness spec 1.0.1 documents both.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,27 @@ All notable changes to LLeMbas CLI. The format follows
 
 ## [Unreleased]
 
+### Added
+
+- `lembas remote list | add <dir>… | remove <dir>… | enable | disable | mode <m> | terminal <on|off>`
+  manages the `remote:` block without editing YAML, keeping the file's comments. `add` stores each
+  directory as an absolute real path, skips one already covered by a root, refuses a missing one
+  (nothing is written), and turns remote work on. `--json` prints one object,
+  `{"enabled", "roots", "max_mode", "terminal"}`, with the defaults applied — for a program such as
+  LLeMbas Desktop.
+
+### Changed
+
+- A running `lembas service` follows the `remote:` block without a restart: roots, mode, trust,
+  terminals and `enabled` are read again whenever they are used (a stat of config.yaml; parsed only
+  when it changed). When what the instance was told changes, the link is dialled again once nothing
+  is working, so the web UI hears the new limits.
+- `lembas service` links even before any folder is allowed; it then accepts no session until one is
+  added. With remote work off or no roots it tells the instance `roots: []` and refuses every
+  session, directory and terminal; before, `service run` exited at once and the instance could not
+  tell "remote off" from "not running".
+- Harness spec 1.0.1: `acp.md` says so.
+
 ## [1.1.0] — 2026-10-14
 
 ### Added