Prevent home-directory settings path collisions

[TheGreatAxios]

Summary

• Prevents global and project-local settings from targeting the same physical path when Corbits starts from home or an aliased config location.
• Recovers exact clobbered OAuth selections and preserves selected models across restart without writing credentials into settings.

Verification

• bun run check passes.
• 127 targeted settings/config/setup tests pass.

Fixes CL-7114
Fixes #703

[linear-code]

CL-7114

[TheGreatAxios]

Review · Approve

Home and aliased settings paths no longer clobber global provider configuration.

No findings.

[TheGreatAxios]

Review · Comment

Local settings resolve to null when <cwd>/.corbits/settings.json is the same physical file as the global target; a global file clobbered with a {provider, model} document is rewritten back to a real settings shape from the OAuth profile store; OAuth provider/model selections persist as credential-free entries in global settings.

Findings

• src/config/settings.ts:409 — physicalPathIdentity rethrows anything that is not ENOENT, and resolveLocalSettingsPath now runs ahead of every fail-open local loader (loadConfig, runExec, runTUI). A stray regular file at <cwd>/.corbits makes realpathSync.native throw ENOTDIR and startup dies before the "never crash startup" path in loadLocalSettingsResult gets a chance (reproduced with touch $D/.corbits; resolveLocalSettingsPath($D, ~/.corbits/settings.json) → throws ENOTDIR). Could the catch fall back to resolve(path) on any error, so an unresolvable path just means "not an alias"?
• src/tui/provider-setup-submit.ts:79 / src/config/settings.ts:246 — OAuth providers are now written to settings.json (defaultProvider + a keyless entry with no apiKey). When the profile is later removed from the auth store, the entry stays: mergeOAuthCatalog filters it out of the catalog, but resolveProvider still selects it via defaultProvider and fails with missing: apiKey, so the next start lands in onboarding with a misleading providerError instead of a clean prompt. Worth either pruning codex//xai/ entries whose profile no longer exists during load, or letting resolution skip an OAuth-named provider that has no projected profile.

Notes

• loadSettingsRecoveringClobberedOAuthSelection also runs for --config <path>. A --config file shaped {provider, model} with no matching profile is rewritten on disk to {"providers":{}} where it used to fail with a schema error. Fine if intended; flagging because it mutates a user-supplied file.
• Checks run: bun run typecheck, bun run lint, bun test src/settings.test.ts src/tui/provider-setup-submit.test.ts src/tui/runner-exit-code.test.ts tests/unit/config.test.ts (128 pass). Commit subjects/bodies pass the length and prefix audit; each commit's file list matches its subject.