Formats 8 files per ruff's line-length=120 configuration:
- src/configdrift/cli.py, diff.py, loader.py
- tests/test_ci_workflow.py, test_cli.py, test_coverage_gaps.py,
  test_diff.py, test_loader.py

Net reduction of 83 lines by consolidating multi-line expressions
that fit within the 120-char limit. All 143 tests pass.

…tests

- SHA-pin actions/checkout@v4 to 11d5960 (v4) in cowork-auto-pr.yml
- Add 5 regression tests for _key_contains_critical_term empty-term
  guard (diff.py:74-75), covering empty-only, mixed, and valid tuples
- 148 tests pass, ruff clean on source/test files

…figs

Implements the missing  command referenced in the project description
('detects and fixes configuration file drift'). Given a baseline and target
config file, overwrites drifted keys in the target with baseline values.

- Supports JSON, YAML, TOML (with optional tomli-w), and flat-key write-back
- Preserves target-only keys (does not delete them)
- Adds missing baseline keys to target
- --dry-run/-n flag to preview without modifying files
- 8 new tests covering JSON/YAML/TOML round-trips, dry-run, edge cases
- All 155 existing tests continue to pass

…tion on crash)

Add _atomic.py module with tempfile+fsync+os.replace pattern for safe writes. Replace all direct file writes in the fix command (JSON/YAML/TOML) with atomic helpers that serialize to buffer first, then write to temp file and atomically rename. Original config files are now preserved intact if the process crashes mid-write (disk full, SIGTERM, power loss). 7 new tests verify the atomic-write contract including failure-mode preservation.

- Preserve nested JSON structure during fix (rebuild from flat keys)
- Handle .env targets in fix command (write flat KEY=VALUE format)
- Process every supplied target file (iterate files[1:], not just files[1])
- Skip write-back when no changes detected (check changes==0)
- Replace scalar parents before rebuilding nested data (scalar-to-mapping drift)
- Preserve target permissions during atomic replacement (copy mode from original)