Reconcile Claude OS-managed settings

[rohita5l]

Summary

• reconcile Claude Code OS-managed settings during interactive configuration while preserving unrelated enterprise policy
• use local settings without sudo for non-interactive launches, with strict conflict detection
• add shared fingerprint, secure backup, immutable-flag, atomic write, status, and drift-safe revert helpers
• keep Claude subscription relay local-only and document the complete two-PR design
• simplify interactive configure output: one password message, one success message, no routine agent-update prompt, and one final opt-in for MCP servers, skills, and plugins

Testing

• 575 passed in focused agent, CLI, update, and managed-file tests
• Ruff lint and changed-file format checks passed
• ty checks passed
• stacked broad validation: 2100 passed, 37 skipped, 4 deselected; five user-agent socket tests were ignored because this sandbox blocks local socket binding

[lilly-luo]

non-interactive examples: https://sourcegraph.prod.databricks-corp.com/databricks-eng/universe/-/blob/lakebox/client_image/claude-wrapper.sh