fix(config): route config_backend to the upgrade lane and fault-inject the seam's parser in the MoA read test

update_channel now writes through hermes_cli.config_backend, so the CI
classifier lists it as an update dependency. The MoA transient-read test
patched hermes_cli.config.fast_safe_load, which the seam no longer calls;
it now patches utils.fast_safe_load, the parser the FileBackend uses.

scripts/ci/classify_changes.py

@@ -346,6 +346,7 @@ _UPDATE_DEPENDENCIES = (
     "hermes_cli/backup.py",  # pre-update backup
     "hermes_cli/backup_cron_prompts.py",  # restore_cron_prompt_fields_if_degraded (update_cmd_config)
     "hermes_cli/backup_restore.py",
+    "hermes_cli/config_backend.py",  # update_channel writes the channel key through the seam
     "hermes_cli/relay_plugin_migrate.py",
     "hermes_cli/macos_tcc_anchor.py",
     "hermes_cli/model_catalog.py",

tests/hermes_cli/test_moa_preset_deletion.py

@@ -269,7 +269,9 @@ def test_moa_save_refuses_transient_read_failure_without_losing_config(tmp_path,
     _seed(tmp_path, monkeypatch, _three_presets(), operator_settings={"keep": None})
     config_path = tmp_path / "config.yaml"
     before = config_path.read_bytes()
-    real_load = config_mod.fast_safe_load
+    import utils
+
+    real_load = utils.fast_safe_load
     failed_reads = []
 
     def fail_once(stream):
@@ -278,7 +280,8 @@ def test_moa_save_refuses_transient_read_failure_without_losing_config(tmp_path,
             raise OSError(errno.EMFILE, "Too many open files")
         return real_load(stream)
 
-    monkeypatch.setattr(config_mod, "fast_safe_load", fail_once)
+    # Config reads go through the ConfigBackend seam, which parses with utils.fast_safe_load.
+    monkeypatch.setattr(utils, "fast_safe_load", fail_once)
     payload = (
         _preset("gpt-5.8").model_dump()
         if legacy else