Preserve cached configuration when refresh fails

Build replacement appenders and thresholds before installing them and
advancing the local version. Release partial replacements and old caches
outside the configuration lock.  In order to make the `ensureFreshness`
version check as cheap as posible and only incur overhead when we
actually need to update the local cache, isolate the refresh logic in a
separate scope to prevent initialization and cleanup of temporary
variables when the version has not changed

Add regression coverage for repeated clone failures, cache preservation,
cleanup, and retry without another configuration change. Update
documentation to reflect the remaining freshness issue.

tests/README.md

@@ -84,7 +84,11 @@ the unsafe forms are tested as compilation failures.
 
 The in-process regression tests are deterministic. The lifetime suite checks
 copying, self-assignment, replacement, moving, container copies, and exporting a
-handle from a local service. Shutdown tests launch
+handle from a local service. Refresh tests verify that repeated clone failures
+preserve the old appenders and thresholds, release partial replacements, and
+allow a later retry without another configuration change. A successful refresh
+releases the replaced cache and installs both appenders and thresholds.
+Shutdown tests launch
 a fresh process for each scenario and check all 10,000 numbered messages after
 normal exit, using isolated temporary paths and a 15-second deadline. Scenarios
 cover stdout, stderr, files, empty formatted messages, multiple file destinations,
@@ -109,8 +113,8 @@ The suite provides targeted regressions; it does not exhaust thread scheduling
 or ORC cycle-collector interleavings.
 
 The ownership scenarios, lifetime suite, and appender-state cleanup regression
-exercise the new ownership contracts. `isEnabled` freshness, failed-refresh
-recovery, local-time timestamp construction, and allocator reports remain for
+exercise the new ownership contracts. `isEnabled` freshness,
+local-time timestamp construction, and allocator reports remain for
 subsequent work.
 
 The standalone `ownership.nim` regression suite passed AddressSanitizer and