make settings persistence safe for nested data and crashes (T-376)

Three failure modes in the YAML store: maps nested inside lists (the
documented keymap-overlay shape) fell through _emitScalar to
toString() and corrupted on the next read; writes went straight to
the live file, so a crash mid-write truncated every setting; and a
parse failure silently returned an empty map that the next set()
wrote over the user's file. Maps in lists now emit as YAML flow
mappings, writes are temp-file + rename, and an unparseable file is
preserved as .broken with a warning through the kernel Logger (new
onError hook, wired in the facade).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -109,6 +109,12 @@ heading, and (b) bumping `pubspec.yaml` `version:` in the same commit.
   D-72's contract), drop or double frames split across reads, and corrupt
   multi-byte characters split across chunks. (T-372)
 
+- **Settings survive nested structures, crashes, and corruption.** Maps
+  inside lists (the keymap overlay shape) were corrupted on save; writes
+  are now atomic (temp file + rename), and a file that fails to parse is
+  preserved as `.broken` with a logged warning instead of being silently
+  reset. (T-376)
+
 - **Accepting ExitPlanMode now leaves plan mode in the conversation panel.**
   Approving Claude's plan (the ExitPlanMode tool) transitioned the underlying
   session out of plan mode, but clide's tracked permission mode didn't follow,