Release 3.8.2.3: cheaper poll I/O, batched macOS sysproxy, no Connect Clone.

Trust corebin cache without Stat; batch networksetup; ActiveProxyURI instead of Config.Clone.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/config/config.go

@@ -325,7 +325,7 @@ func WriteExample(path string) error {
 	return Save(path, Example())
 }
 
-// Save writes config as indented JSON.
+// Save writes config as indented JSON (atomic replace).
 func Save(path string, cfg Config) error {
 	if err := cfg.Validate(); err != nil {
 		return err
@@ -341,7 +341,15 @@ func Save(path string, cfg Config) error {
 			return err
 		}
 	}
-	return os.WriteFile(path, data, 0o600)
+	tmp := path + ".tmp"
+	if err := os.WriteFile(tmp, data, 0o600); err != nil {
+		return err
+	}
+	if err := os.Rename(tmp, path); err != nil {
+		_ = os.Remove(tmp)
+		return err
+	}
+	return nil
 }
 
 // SetActiveProxy updates the active profile proxy URI.