Set when the config file existed but could not be read or parsed.
load() degrades to an empty config on malformed TOML or an unreadable
file so unrelated startup keeps working, but the user explicitly opted into
a sandbox. Callers surface this so the failure isn't invisible (a bare
logger.warning never reaches the TUI).
