fix: resolve symlinks before atomic write, validate dry-run format support

- _atomic.py: resolve symlinked paths before creating the temp file
  and os.replace so the referent is updated rather than the link being
  replaced by a regular file (preserves the symlink and its target).
- cli.py: validate write-back format support during --dry-run so the
  dry run accurately predicts whether the real run would succeed.
  Unsupported extensions and missing tomli-w are reported as failures
  in both modes.

Addresses Codex review: _atomic.py:38 (P1), cli.py:360 (P2)

Author: Coding-Dev-Tools

src/configdrift/_atomic.py

@@ -18,9 +18,13 @@ def atomic_write_text(path: Path, text: str, encoding: str = "utf-8") -> None:
 
     Creates a temporary file beside *path*, writes + fsyncs, then
     ``os.replace()`` for an atomic rename.  Preserves the original
-    file's permissions when it already exists.
+    file's permissions when it already exists.  When *path* is a
+    symlink, resolves it first so the referent is updated rather than
+    the link being replaced by a regular file.
     """
-    parent = path.parent
+    # Resolve symlinks so we update the target file, not replace the link.
+    resolved = path.resolve() if path.is_symlink() else path
+    parent = resolved.parent
     parent.mkdir(parents=True, exist_ok=True)
     fd, tmp = tempfile.mkstemp(dir=parent, suffix=".tmp")
     try:
@@ -29,13 +33,13 @@ def atomic_write_text(path: Path, text: str, encoding: str = "utf-8") -> None:
             fh.flush()
             os.fsync(fh.fileno())
         # Preserve target permissions during atomic replacement
-        if path.exists():
+        if resolved.exists():
             try:
-                st = path.stat()
+                st = resolved.stat()
                 os.chmod(tmp, st.st_mode)
             except OSError:
                 pass
-        os.replace(tmp, path)
+        os.replace(tmp, resolved)
     except BaseException:
         # Clean up temp file on any failure
         with contextlib.suppress(OSError):
@@ -47,8 +51,11 @@ def atomic_write_bytes(path: Path, data: bytes) -> None:
     """Atomically write *data* to *path*.
 
     Preserves the original file's permissions when it already exists.
+    When *path* is a symlink, resolves it first so the referent is
+    updated rather than the link being replaced by a regular file.
     """
-    parent = path.parent
+    resolved = path.resolve() if path.is_symlink() else path
+    parent = resolved.parent
     parent.mkdir(parents=True, exist_ok=True)
     fd, tmp = tempfile.mkstemp(dir=parent, suffix=".tmp")
     try:
@@ -57,13 +64,13 @@ def atomic_write_bytes(path: Path, data: bytes) -> None:
             fh.flush()
             os.fsync(fh.fileno())
         # Preserve target permissions during atomic replacement
-        if path.exists():
+        if resolved.exists():
             try:
-                st = path.stat()
+                st = resolved.stat()
                 os.chmod(tmp, st.st_mode)
             except OSError:
                 pass
-        os.replace(tmp, path)
+        os.replace(tmp, resolved)
     except BaseException:
         with contextlib.suppress(OSError):
             os.unlink(tmp)

src/configdrift/cli.py

@@ -357,6 +357,22 @@ def fix(
             continue
 
         if dry_run:
+            # Validate that the target format supports write-back even in
+            # dry-run mode so --dry-run accurately predicts whether the
+            # real run would succeed.
+            ext = target_path.suffix.lower()
+            supported_exts = {".json", ".yaml", ".yml", ".toml", ".env"}
+            if ext == ".toml":
+                try:
+                    import tomli_w  # noqa: F401
+                except ImportError:
+                    console.print("[red]Error: tomli-w is required to write TOML files. Install with: pip install tomli-w[/red]")
+                    failed_targets.append(str(target_path))
+                    continue
+            elif ext not in supported_exts:
+                console.print(f"[red]Error: unsupported format '{ext}' for write-back of {target_path}.[/red]")
+                failed_targets.append(str(target_path))
+                continue
             console.print(f"[yellow]Dry run: {changes} key(s) would be updated in {target_path}[/yellow]")
         else:
             ext = target_path.suffix.lower()