The container refusal for the bare `model` shorthand only ran when the
existing `model` value was a mapping. With `model` absent or a string
shorthand, `hermes config set model '[a, b]'` wrote `model: [a, b]`,
a shape no model reader accepts (#131435 gate finding).
Hoist the refusal ahead of the mapping-section early-out: a list is
refused whenever --force is not given; a mapping is still refused only
over an existing section, since a mapping over an absent/string model
is a valid section write. Extends the kept refusal test with
absent/string-model list rows.
824c2ad446