Return the process snapshot, or an isolated snapshot for an explicit path.
A reload that cannot parse the file never evicts policy that parsed
cleanly earlier. An unusable snapshot carries data == {}, which every
reader would otherwise treat as "nothing is enforced", so caching it would
turn one broken write by an administrator into a process-wide fail-open.
A refresh caller still receives the failed load, so health checks see the
error. A non-refresh caller may instead receive a generation another caller
published while this load was failing, because the serialized path it
replaces would have read that from the cache and never loaded at all.
The same holds for a file that parses but cannot be enforced. Its health
is OK, so a usability check alone would cache it. When the refresh
raises ManagedPolicyError (as require_healthy_managed_config does),
the rejected candidate must not stay in the cache: the reload keeps the
previous settings, but a later non-refresh reader would otherwise observe
the rejected snapshot and, for example, re-enable a managed MCP deny the
edit removed. Validate enforceability before caching, so the cache holds
only the last enforceable snapshot.
