fix: abort on chown failure, recursive TOML null check, reject \r in dotenv values

- _atomic.py: abort atomic replacement when os.chown fails instead of
  silently installing a caller-owned file the application cannot read.
  Both atomic_write_text and atomic_write_bytes now raise OSError with
  a descriptive message when ownership preservation fails.
- cli.py TOML null check: recursively scan lists and nested dicts for
  embedded None values so cross-format fixes like items: [1, null]
  fail cleanly before tomli_w raises TypeError during serialization.
- cli.py dotenv multiline: reject carriage returns (\r) alongside
  newlines (\n) since universal-newline readers treat \r as a line
  boundary, truncating the setting and causing perpetual drift.

Addresses Codex review: _atomic.py:44 (P1), cli.py:514 (P2),
cli.py:562 (P2)

Author: Coding-Dev-Tools

src/configdrift/_atomic.py

@@ -32,16 +32,22 @@ def atomic_write_text(path: Path, text: str, encoding: str = "utf-8") -> None:
             fh.write(text)
             fh.flush()
             os.fsync(fh.fileno())
-        # Preserve target permissions and ownership during atomic replacement
+        # Preserve target permissions and ownership during atomic replacement.
+        # If ownership restoration fails (e.g. unprivileged caller), abort
+        # the replacement rather than installing a caller-owned file that
+        # the application cannot read.
         if resolved.exists():
+            st = resolved.stat()
+            os.chmod(tmp, st.st_mode)
             try:
-                st = resolved.stat()
-                os.chmod(tmp, st.st_mode)
-                # Preserve owner so application accounts can still read the
-                # config after a privileged deployment user runs fix.
                 os.chown(tmp, st.st_uid, st.st_gid)
-            except OSError:
-                pass
+            except OSError as chown_err:
+                with contextlib.suppress(OSError):
+                    os.unlink(tmp)
+                raise OSError(
+                    f"Cannot preserve ownership of {resolved} "
+                    f"(uid={st.st_uid}, gid={st.st_gid}): {chown_err}"
+                ) from chown_err
         os.replace(tmp, resolved)
     except BaseException:
         # Clean up temp file on any failure
@@ -66,14 +72,21 @@ def atomic_write_bytes(path: Path, data: bytes) -> None:
             fh.write(data)
             fh.flush()
             os.fsync(fh.fileno())
-        # Preserve target permissions and ownership during atomic replacement
+        # Preserve target permissions and ownership during atomic replacement.
+        # If ownership restoration fails, abort rather than installing a
+        # caller-owned file the application cannot read.
         if resolved.exists():
+            st = resolved.stat()
+            os.chmod(tmp, st.st_mode)
             try:
-                st = resolved.stat()
-                os.chmod(tmp, st.st_mode)
                 os.chown(tmp, st.st_uid, st.st_gid)
-            except OSError:
-                pass
+            except OSError as chown_err:
+                with contextlib.suppress(OSError):
+                    os.unlink(tmp)
+                raise OSError(
+                    f"Cannot preserve ownership of {resolved} "
+                    f"(uid={st.st_uid}, gid={st.st_gid}): {chown_err}"
+                ) from chown_err
         os.replace(tmp, resolved)
     except BaseException:
         with contextlib.suppress(OSError):

src/configdrift/cli.py

@@ -509,10 +509,18 @@ def fix(
 
                     # Reject None values before building the TOML dict —
                     # TOML has no null representation, so tomli_w would
-                    # raise TypeError on serialization.
-                    has_null = any(v is None for v in target_data.values())
-                    if has_null:
-                        null_keys = [k for k, v in target_data.items() if v is None]
+                    # raise TypeError on serialization. Check recursively
+                    # through lists and nested dicts for embedded nulls.
+                    def _has_null(val: Any) -> bool:
+                        if val is None:
+                            return True
+                        if isinstance(val, dict):
+                            return any(_has_null(v) for v in val.values())
+                        if isinstance(val, (list, tuple)):
+                            return any(_has_null(v) for v in val)
+                        return False
+                    null_keys = [k for k, v in target_data.items() if _has_null(v)]
+                    if null_keys:
                         console.print(
                             f"[red]Error: TOML does not support null values. "
                             f"Keys with null: {', '.join(null_keys[:5])}[/red]"
@@ -553,17 +561,19 @@ def fix(
                     )
                     failed_targets.append(str(target_path))
                     continue
-                # Reject multiline values — newlines would corrupt the
-                # dotenv file by splitting a single KEY=VALUE across
-                # multiple physical lines.
+                # Reject multiline values — newlines (\n) and carriage
+                # returns (\r) would corrupt the dotenv file by splitting
+                # a single KEY=VALUE across multiple physical lines.
+                # Readers using universal-newline handling treat \r as a
+                # line boundary, truncating the setting.
                 multiline_keys = [
                     k for k, v in target_data.items()
-                    if isinstance(v, str) and '\n' in v
+                    if isinstance(v, str) and ('\n' in v or '\r' in v)
                 ]
                 if multiline_keys:
                     console.print(
-                        f"[red]Error: dotenv values must not contain newlines. "
-                        f"Keys with newlines: {', '.join(multiline_keys[:5])}[/red]"
+                        f"[red]Error: dotenv values must not contain newlines or "
+                        f"carriage returns. Keys affected: {', '.join(multiline_keys[:5])}[/red]"
                     )
                     failed_targets.append(str(target_path))
                     continue