Port sfdc to cli-common statedir resolver (+ config atomic + perms) — parked Phase-B unit

[rianjs]

working-with-state.md §6.4 unit 6 — sfdc (independent single-scope unit, no disk cache). PARKED: this is the deferred Phase-B unit; ticket exists for tracking but stays Backlog until the parking is lifted.

Scope (when unparked)

• sfdc config hand-rolled ~/.config (all OSes), file is legacy config.json (the reason it is parked) → cli-common/statedir Scope{Name:"salesforce-cli"}. macOS/Windows relocation; Linux unchanged. Decide config.json→config.yml as part of (or explicitly deferred within) this unit.
• Config write: plain os.WriteFile → atomic temp-file-rename. Perms dir 0700/file 0600 (verify).
• No disk cache — no cache work.
• State tests via cli-common/statedirtest.

§3.2 acceptance matrix (merge gate)

Declare copy-vs-move / second-run / downgrade-fork. Prove all 8 cases against sfdc's real legacy config.json source. Conflicting old vs new ⇒ fail loud.

Out of scope

• Lifting the Phase-B parking decision (separate call).
• Cutting the cli-common semver tag (closing ticket).

Depends on commons (MON-5364 / cli-common#18, merged). Order per §6.4 (last). Keep Backlog/parked.

Jira: MON-5374 (child of INT-310, KTLO)