[falbany]

Closes #116.

What

Two independent protections for the user's only .profiles file, exactly as scoped in #116:

1. Atomic writes (torn-write protection)

profiles.core.config.io.yaml_io gains write_text_atomic(): text goes to a temp file in the target directory (so os.replace stays on one filesystem and remains atomic), is flushed + fsynced, then renamed over the target. A crash or power loss mid-save can no longer leave a truncated config behind. Both /api/config/save and /api/config/save-as route through it.

2. Staleness guard (silent-clobber protection)

• GET /api/config/content now also returns content_hash (SHA-256 of the served text) — previously the client had no version marker at all.
• POST /api/config/save accepts an optional baseline_hash: when the on-disk file no longer matches, it answers 409 ("The configuration file changed on disk since it was loaded") instead of writing. overwrite_changes=true is the "overwrite anyway" escape hatch. A vanished file also 409s rather than being silently recreated.
• Both save responses carry content_hash of what was written — the next save's baseline.
• Optional field → older callers and the legacy no-baseline behavior are unaffected (no breaking change).

Web (ConfigEditorModal)

• Every load/Revert records the baseline hash; every Save sends it; every successful save refreshes it from the response. New (template) clears it.
• On 409 a "File changed on disk" ConfirmDialog parks on the in-flight save (same promise pattern as the compliance gate):
  • Reload disk version — re-fetches and adopts the external edits, discarding the editor's text;
  • Overwrite anyway — retries the same text with overwrite_changes: true.
• The dialog is integrated with the existing guards: parked-state (no auto-validation churn), Ctrl/Cmd+S swallow, stale-seq invalidation.

Not in scope

• Baseline check on /save-as — the editor's baseline describes the file it loaded, not the save-as target; the existing 409 existing-target guard covers that path (documented in the docstring).
• Live file watcher / .bak files — the issue's rejected alternatives.

Tests

• Core: write_text_atomic (writes, replaces, no temp litter — including on a forced os.replace failure) + content_hash unit tests.
• Routes: content hash on both branches; 409 stale + bytes untouched; matching baseline saves; overwrite_changes wins; no-baseline legacy pin; vanished file 409; save-as response hash.
• Web: client contract (baseline/overwrite fields on the wire); three editor flows — overwrite path, reload path, baseline refresh across saves.
• Full gates: pytest 1505 passed / 1 skipped (cov 88.67%), vitest 246 passed (14 files), ruff format/check clean, pylint 9.89/10, pyright 0 errors.

Docs: the /api/config endpoint contracts in docs/advanced/advanced-guide.en.md + guide-avance.fr.md updated. dist/ rebuilt and committed per convention.