Load one user snapshot and the current managed snapshot.
Managed policy is included exactly when user_path is None, which is
what every production caller passes. Reading an explicit path is a
test-and-tooling operation on one file, and its result must not be mistaken
for the effective configuration.
Deliberately not a caller-supplied flag: an include_managed=False source
is indistinguishable from a machine with no policy installed, because the
fabricated status reports MISSING and the table is empty. Deriving it here
keeps that state one keyword out of reach.
Read this file as the user layer instead of the default, and exclude managed policy. Intended for tests and for tooling that inspects one file.
Read managed policy from this file instead of the fixed OS path, bypassing the process snapshot. Intended for tests.
