Treat duplicate YAML and JSON target keys consistently and reject restore targets that escape the home directory

[latedeployment]

Summary

• Fix YAML and JSON config readers to evaluate the last duplicate target key, matching common effective-value behavior.
• Update YAML and JSON fixers to rewrite all duplicate target keys instead of only the first occurrence.
• Harden backup restore path validation to reject parent-directory escapes, symlink restore targets, and canonical parent paths outside the home directory.
• Add regression tests for duplicate key scanning/fixing and restore path escape rejection.

Testing

• cargo fmt -- --check
• cargo clippy -- -D warnings
• cargo test
• cargo build --release

Verified again after rebasing onto latest origin/main.

AI / agent disclosure

Codex — GPT-5.