Add an env var to bypass managed-settings writes entirely

[naveenrajkumar]

Problem

ug configure tries to write agents' OS-managed settings files (e.g. /Library/Application Support/ClaudeCode/managed-settings.json), which needs sudo. When that write isn't possible, recent changes fall back to local settings (src/ucode/agents/claude.py:1170, src/ucode/agents/codex.py:578).

That fallback makes ug behave differently depending on whether a managed-settings file exists and whether the user can get root:

• users with managed settings get one config precedence and one set of enforced values;
• users without them (or who decline sudo) silently get local settings instead;
• the resulting warnings, conflict errors, and ug revert behavior differ between the two groups.

This is a real devx problem: the same command on two machines produces different configuration, and bug reports are hard to reproduce because we don't know which path a user took.

Proposal

Add an opt-out env var so the managed-settings path — creation, update, and reconcile — is skipped entirely and ug always uses local settings:

UCODE_DISABLE_MANAGED_SETTINGS=1

In our setup, managed settings are deployed and maintained through organisation admin tooling (MDM), not by ug. So ug doesn't need to create or update those files at all — it should be able to leave them alone and configure local settings consistently for every user.