claude mcp add reports success when the config write is denied (sandboxed Bash)

**Version:** 2.1.273 and 2.1.274 (native, macOS arm64)

## What happens

Run inside the Claude Code Bash tool with the sandbox enabled (`sandbox.enabled: true`), where `~/.claude.json` is a protected write path:

```
claude mcp add --scope user sbx-probe-noop -- /usr/bin/true
```

Output:

```
Added stdio MCP server sbx-probe-noop with command: /usr/bin/true to user config
File modified: /Users//.claude.json
```

Exit status 0. The server is not saved:

```
claude mcp get sbx-probe-noop # -> No MCP server named "sbx-probe-noop"
```

Reproduced three times (2.1.273 twice, 2.1.274 once). `claude mcp get` exits 1.

## Why

- Opening `~/.claude.json` for writing (`r+`) from the sandbox fails with `EPERM`. Separately, a create-then-rename onto a *different, non-existing* protected path also failed with `EPERM`; rename onto `~/.claude.json` itself was not tested, to avoid overwriting live config.
- Blocking is expected: the sandboxing docs say protected paths exist because a command "could … add a hook or MCP server that Claude Code runs outside the sandbox".
- The defect is the report. Possibly relevant, from reading the minified 2.1.273 bundle (names will differ across versions): the global-config save path catches the error, logs `Failed to save config with lock: …`, and returns `false`, and one wrapper has the form `….then(()=>{return})`, which discards that result. The `mcp add` handler prints the success lines after `await`.
- I could not confirm that `mcp add`'s save call goes through that wrapper; the observed behavior is consistent with it but this is not verified.

## Expected

When the config write fails, `claude mcp add` should print an error (e.g. "Could not write ~/.claude.json: EPERM — run this outside the sandbox with `!`") and exit non-zero.

## Workaround

Run `claude mcp add` via `!` (outside the sandbox) and verify with `claude mcp get `.

## Search done

CHANGELOG.md full text: no entry about `mcp add` reporting success on a failed save. Issue search (`claude.json sandbox mcp add`, `"File modified" claude.json not saved`): 0 results.

First reproduce the failure with `claude mcp add --scope user sbx-probe-noop -- /usr/bin/true` inside the sandbox. Then inspect the minified 2.1.273 bundle's global-config save path and the `mcp add` handler, especially the reported discarded save result. Done means a denied write prints an error and exits non-zero instead of reporting success.

Written by the indexing model from the issue text.