bug: make base_app_config_load transactional on failure

[codeforester]

Goal

Make base_app_config_load publish a complete effective configuration only after every source and required-value check succeeds.

Background

base_app_config_load clears the model's published values, applies defaults, files, environment, and CLI values directly to global state, and returns immediately on the first error. A late malformed record, invalid value, unknown CLI key, or missing required value therefore leaves a partial configuration visible through base_app_config_get and base_app_config_provenance.

Callers that correctly check the nonzero status can still accidentally observe the failed attempt later, and a previously valid snapshot is destroyed. The focused BATS tests assert the error but not state preservation.

Reproduction and evidence

Framework reference: 23797a73b2 on main.

1. Define mode with default dev and required secret secret.
2. Successfully load secret=old-secret.
3. Load a project file containing mode=prod followed by not-a-record, with a new CLI secret.

Current result:

ERROR: ... line 2 is not key=value data.
status=2 mode=prod secret=unset

The failed load has partially committed the first file record and erased the previous secret.

Scope

• Stage effective values and provenance separately from the published model state.
• Validate all requested files, environment values, CLI values, validators, and required keys before commit.
• On any failure, preserve the last successful snapshot unchanged.
• Document the failure-state contract.
• Add late-failure regression coverage for each precedence layer.

Acceptance criteria

• A failed load cannot publish a mixture of old, default, and partially read new values.
• The last successful values and provenance remain available after failure.
• A successful load atomically replaces the complete snapshot.
• Existing precedence and redaction behavior remains unchanged.
• ./tests/validate.sh passes.

Non-goals

• Redesigning the key=value file syntax or precedence order.

Project fields

• Status: Backlog
• Priority: P1
• Area: Runtime
• Initiative: Adoption Polish
• Size: M

Ownership

• Assignee: @codeforester