plugins.isolation is profile config, so a profile (or its agent) can set it back to in_process. The managed scope already beats profile config and makes `hermes config set` refuse, and the isolation reader goes through that overlay; document it as the operator lock and pin the contract with a test (red when isolation_mode() reads the raw profile file).