Fall back to local settings when sudo is unavailable

[andy-xu-db]

Summary

• treat failed privileged managed-settings writes as recoverable
• continue with the already-written local Claude Code or Codex settings when no OS-managed value conflicts
• preserve the existing launch blocker when an OS-managed value would override local settings
• add regression coverage for compatible and conflicting settings

Fixes #554

Testing

• uv run ruff check .
• uv run pytest tests/test_managed_files.py tests/test_agent_claude.py tests/test_agent_codex.py -q (218 passed)
• uv run pytest -q (2205 passed, 42 skipped, 2 environment-dependent installed-client integration failures)

The two full-suite failures are TestClaudeUserAgent::test_user_agent_arrives_at_gateway and TestCodexUserAgent::test_user_agent_arrives_at_gateway; both reproduce on an untouched main checkout with the locally installed agent versions.

Docker test without sudo access

Tested both versions in the same container as a non-root ugtest user that was not present in sudoers:

• This PR: the Claude path reported the sudo denial, fell back to ~/.claude/ucode-settings.json, left /etc/claude-code/managed-settings.json absent, and succeeded.
• This PR: the Codex path behaved equivalently, using its local settings file and succeeding.
• Unchanged origin/main: the Claude configuration path exited with status 1 and RuntimeError: Claude Code cannot start because ucode could not update /etc/claude-code/managed-settings.json.

These Docker checks directly exercised the configuration-writing paths under identical no-sudo conditions. They did not perform a fully authenticated end-to-end agent launch, which requires Databricks workspace credentials and installed Claude/Codex clients.