Allow a stand-local alarm configuration - #129

Laboratory deployment failure corrected

config/*.local.yaml is the stand-specific authority pattern, but alarms_v3.yaml was loaded directly and had no local replacement. A laboratory with a different sensor roster therefore had to edit the tracked alarm file merely to boot, carrying permanent merge conflicts in a safety-relevant configuration.

When config/alarms_v3.local.yaml exists, this change selects it as a whole-file replacement. Otherwise the tracked base remains authoritative. The selected file is used consistently for alarm parsing, protected-pattern extraction, and complete alarm-reference liveness validation.

The local file is not a bypass:

• malformed YAML fails before the persistence writer is created;
• a dangling channel reference fails the existing startup liveness gate;
• a dangling symlink is treated as a selected but unreadable local authority and fails closed;
• no stand-specific channel list is committed here.

Evidence

On exact master, the four new startup controls failed: the tracked file was chosen instead of the local replacement, and malformed alarm files reached persistence without shape validation.

With this change:

• Windows affected suites: 160 passed;
• Ubuntu 22.04 affected suites: 160 passed;
• read-only Ruff lint and format checks passed;
• git diff --check passed.

The open pull-request queue was checked by changed file. Several older pull requests also touch engine.py, but none implements stand-local whole-file alarm authority; this is file contention, not a duplicate subject.

This pull request remains a draft until the exact-head Codex review has no findings. Full hosted CI is intentionally deferred until then.