fix(config): close temporary descriptor when writer setup fails

[workstonedai-collab]

Summary

• Close the raw mkstemp descriptor when permission or stream initialization fails.
• Transfer ownership to the file object explicitly after successful fdopen.
• Add regressions for both failure stages, including old-file preservation,
  in-memory rollback, temporary-path cleanup, and descriptor closure.

The successful atomic-write path and configuration format remain unchanged.
This is separate from the directory-permission work in
PR #687.

Evidence

Baseline a19a171fa980a0785849596492e0af4db800c82f: both new cases fail because
the descriptor is still open. With this patch, the same cases pass.

Testing

python -m pytest -q
ruff check agent_reach tests
python -m mypy agent_reach
git diff --check

Results: 609 tests pass in the full suite; whole-project Ruff checks and mypy
checks pass (36 source modules); whitespace check passes.
The two touched files retain pre-existing Ruff formatter differences; comparison
with the baseline confirms the patch adds no extra formatter differences.
Whole-project test, lint and typing gates passed locally. Upstream CI is pending.

Scope and data

Only upstream configuration writer code and synthetic tests are included.
No product code, user configuration, API credentials, or operational logs are part
of this patch. No issue number is claimed as closed until an upstream report exists.