Embody v5.0.397: set_dat_content wipe guardrail, TDN at-risk filter, settings sort fix (#18), test debt cleanup

Three independent improvements bundled together: a wipe guardrail on
the set_dat_content MCP tool to prevent silent destruction of user
content from malformed agent calls, a TDN at-risk filter that excludes
TD-managed read-only DAT types from the save-time content-loss
warning, and a deterministic settings serialization fix that closes
issue #18. Plus a substantial test-debt cleanup that brings the
previously-failing legacy tests back to green.

- Wipe guardrail on set_dat_content: refuses calls whose result would
  empty a DAT (text='', rows=[], or clear=True with no replacement)
  unless caller passes confirm_wipe=True. Plus a no-content guard for
  text=None, rows=None, clear=False -- same failure shape (silent
  confused success), refused the same way. Error message points back
  to get_dat_content as the proper read-modify-write workflow. Tests
  cover all guard paths plus the no-partial-mutation guarantee.
- TDN at-risk dialog skips TD-managed read-only DAT types
  (info, webrtc, folder, monitors, devices, etc.) so the warning only
  fires for content the user actually authored. Callback DATs
  (executeDAT family) are intentionally NOT excluded.
- Issue #18: .embody/config.json byte-stable across saves via sorted
  iteration of _PERSISTED_PARAMS + sort_keys=True in json.dumps.
  Reported by chrsmlls333.
- Test debt cleanup: 28 stale .txt test duplicates removed,
  test_ancestor_rename tearDown leak fixed (4 tests now reliable),
  3 envoy_bridge stubs converted to 6 real tests + 1 deleted,
  test_tdn_reconstruction V03/V07/V12 aligned with current production
  contract (native widget COMPs export as regular COMPs).
- 23 new tests across 4 files; test count: 48 → 49.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>