openbao's "write config only if absent" pattern would silently skip
newly-required keys on a rejoué script. ini_set() merges key by key
instead: creates file/section/key as needed, replaces an existing
key's value in place, no-ops when already correct, and never touches
other sections — so a duplicate key name across sections (e.g.
[metrics] ENABLED vs [actions] ENABLED) stays scoped correctly.
Atomic write via tmpfile + mv. First OS-agnostic helper in the file,
documented as such in the header contract.
Refs #18
Damien
66f981af81