Serialize a read-modify-write of the user config and replace it atomically.

Writes the user tier only. The managed path is refused rather than trusted to be unreachable.

A committed write to the default path also refreshes the shared process resolver, so later reads see the new value. That refresh is best-effort and never turns a landed write into a reported failure; see refresh_shared_resolver.