write-proxy-config is not idempotent across repeated runs

Summary

The write-proxy-config helper is not idempotent when it is run more than once against the same action home directory.

Each run writes a fresh action-managed proxy selection and provider table around the existing config.toml contents. If the helper runs twice, the config can contain duplicate root provider selections and duplicate proxy provider tables. The stale port from the first run can also remain in the file.

Reproduction

1. Create a temporary action home directory.
2. Run write-proxy-config once with port 1111.
3. Run write-proxy-config again against the same home directory with port 2222.
4. Inspect config.toml.

Expected behavior

The helper should replace its own managed proxy config and leave exactly one managed provider selection and one managed provider table. Re-running with a new port should update the managed table to the new port.

Actual behavior

The helper appends/prepends another managed config entry, leaving duplicate provider selections/tables and potentially retaining a stale port.

Notes

This is related to #80, but narrower: this issue is only about idempotency of the action-managed proxy config. PR #104 contains a focused fix for this case.

Start at the write-proxy-config helper and reproduce the two-run sequence against the same action home directory, using ports 1111 and 2222. Inspect config.toml after the second run; done means it contains exactly one managed provider selection and table, with the managed table using port 2222. PR #104 is noted as a focused fix for this case.