Fix harden false success on failed config writes

[cedric013]

Summary

lean-ctx harden can report success even when JSON config writes fail.

Problem

The soft harden path currently ignores write errors when updating MCP configs and Claude settings. This can print OK or report harden undo success even though the config was not written.

Expected behavior

• Only print OK after a successful write.
• Surface write/serialization failures to stderr.
• Avoid reporting undo as fully successful when one config mutation fails.
• Use the existing atomic config write path for JSON config updates.

Validation

Please validate through CI on the associated PR.