lembas remote: manage remote: without YAML; a running service follows it

`lembas remote list | add | remove | enable | disable | mode | terminal`, with
`--json` printing {enabled, roots, max_mode, terminal}, for LLeMbas Desktop.
Writes go through the global config writer and keep comments.

The device's limits are now live getters over the remote: block, re-read when
config.yaml's stat changes. `lembas service` links even with remote work off
or no roots: it says roots: [] and refuses every session, directory and
terminal, so the instance can tell "no folder allowed yet" from "not running".
When what the instance was told changes, the link re-dials once nothing is
working, so `lembas remote add` or `enable` takes effect without a restart.
Harness spec 1.0.1 documents both.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/config/write.ts

@@ -1,15 +1,22 @@
-// Settings the TUI remembers (/personality, /theme) go into the global config.yaml, keeping the
-// comments and layout of whatever the user wrote there.
+// Settings the TUI remembers (/personality, /theme) and `lembas remote` go into the global
+// config.yaml, keeping the comments and layout of whatever the user wrote there.
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"
 import { join } from "node:path"
 import { parseDocument } from "yaml"
 import { paths } from "./paths.ts"
 
 export function setGlobalConfig(path: string[], value: unknown) {
+  updateGlobalConfig([[path, value]])
+}
+
+/** Several values at once, in one write: a reader (a running service) never sees half of them.
+ *  Written in place, not renamed over: a config.yaml that is a link into a dotfiles repository
+ *  stays one, and keeps its mode. A reader that catches it half written keeps what it read last. */
+export function updateGlobalConfig(edits: [string[], unknown][]) {
   const file = join(paths.config, "config.yaml")
   mkdirSync(paths.config, { recursive: true })
   const doc = parseDocument(existsSync(file) ? readFileSync(file, "utf8") : "")
   if (!doc.contents) doc.contents = doc.createNode({}) as never
-  doc.setIn(path, value)
+  for (const [path, value] of edits) doc.setIn(path, value)
   writeFileSync(file, doc.toString())
 }