Enterprise-managed MCP config now degrades gracefully when it can't be read

What

• If the enterprise-managed MCP configuration (which controls which MCP servers are allowed) is unreadable or fails to parse, Claude Code now says so explicitly, with a message like "Enterprise MCP config ... cannot be read or parsed (...), so it keeps exclusive control."
• When the managed config is valid, dynamically-configured MCP servers that conflict with it are still refused as before; when the managed config is broken, individual conflicting servers are instead dropped one at a time (with a warning listing which ones), rather than refusing the whole run.
• A new unusableManagedMcpConfigMessage app-state field surfaces this parse failure in the UI.
• More generally, managed/enterprise settings loading now reports parse and read errors via a fatalErrors() method, and unreadable managed settings makes hook editing (edit_hook) refuse every edit and locks host editing controls.
• New schema fields policyUnreadable (on the hook-editing status) and remote_control_policy_lock_reason (explaining why org policy locks remoteControlAtStartup) describe this same fail-closed behavior.

Why Previously a broken or unreadable enterprise policy file could produce a confusing, undifferentiated failure. Now Claude Code fails closed (locking things down rather than silently ignoring policy) but tells the user specifically what's wrong, so admins and users can fix the underlying config instead of guessing.