`hermes config set model '<json>'` printed a success line while
redirecting the raw JSON text into `model.default` as the model id
(#131435, item 6): `model` is seeded as a string default, so the
generic coerce kept the literal verbatim, the bare-name shorthand rode
it into `model.default`, and every runtime reader then failed to
resolve the route while `config get` echoed it back.
Parse the literal first so the section guard sees the real shape:
- bare `model` + a mapping/list literal without --force is refused with
a pointer to `model.provider` / `model.default` (the same fail-closed
shape the container-slot guard took in #114471)
- with --force the validated mapping replaces the whole section, which
is the documented force meaning for section writes
(cherry picked from commit c08983182745c3eae395834a1fd5081a3b0267e7)
a03d0f8e7d