Return the process snapshot, or an isolated snapshot for an explicit path.
A reload that cannot parse the file never evicts policy that parsed
cleanly earlier. An unusable snapshot carries data == {}, which every
reader would otherwise treat as "nothing is enforced", so caching it would
turn one broken write by an administrator into a process-wide fail-open.
The caller still receives the failed load, so health checks see the error.
The same holds for a file that parses but cannot be enforced. Its health
is OK, so a usability check alone would cache it. When the refresh
raises ManagedPolicyError (as require_healthy_managed_config does),
the rejected candidate must not stay in the cache: the reload keeps the
previous settings, but a later non-refresh reader would otherwise observe
the rejected snapshot and, for example, re-enable a managed MCP deny the
edit removed. Validate enforceability before caching, so the cache holds
only the last enforceable snapshot.
