require_healthy_managed_config(
*,
refresh: bool = False,
) -> NoneFail startup when present managed policy cannot be parsed or enforced.
A file that parses is not necessarily enforceable: a privilege-affecting key can carry a value the manifest rejects, or a known section can be a scalar instead of a table. Both can otherwise resolve in the user's favor or erase a user subtree, so they stop the launch here rather than at each consumer.