fix(config-profiles): synchronize shared mount working copies

Use canonical profile files and writable Git working copies so editor and container changes share one source. Require confirmation before destructive Git refreshes and overlay profile files without composite snapshots.

apps/api/tests/unit/test_config_profile_refresh.py

@@ -0,0 +1,23 @@
+"""Tests for Config Profile refresh safety contracts."""
+
+import uuid
+from unittest.mock import AsyncMock
+
+import pytest
+from fastapi import HTTPException
+
+from src.api.config.config_profiles import refresh_profile_git_mounts
+
+
+@pytest.mark.unit
+async def test_git_refresh_requires_destructive_confirmation() -> None:
+    """The endpoint must not reset a writable working copy without consent."""
+    with pytest.raises(HTTPException) as exc_info:
+        await refresh_profile_git_mounts(
+            profile_id=str(uuid.uuid4()),
+            confirm_destructive_refresh=False,
+            current_user_id=uuid.uuid4(),
+            session=AsyncMock(),
+        )
+
+    assert exc_info.value.status_code == 409