fix(drive): warn on a broken settings.json in lease resolve

[newhoggy]

Summary

• A drive lease command with a broken settings.json now warns instead of silently falling back to defaults — closing a gap where a broken config could silently downgrade the auth policy to the less-secure direction with no indication anything was wrong.
• Fixes fix(drive): LeaseFlags::resolve silently drops biometrics_only when settings.json fails to parse #1695.

Test plan

• cargo build
• cargo test --lib cli::drive::lease:: (includes the new regression test)
• cargo clippy --all-targets -- -D warnings

[github-actions]

Coverage

Total: 97.27% ⚪ 0 pp vs main

Comparing 87d2112..ab101d8 (merge-base → PR head)

File	Before	After	Δ
src/cli/drive/lease.rs	99.27%	98.96%	🔴 -0.31 pp

🔇 5 ignored region(s), 0 tolerated region(s)

ignore removes the lines from both reports; tolerate keeps them in the reported percentage but scores them against the baseline, so a cross-run flip cannot move a delta. Regions are read from each revision's own source.

File	Kind	Lines	Rev	Reason
src/cli/drive/lease.rs	ignore	418-422	both	a sheet restore's fresh backup is always a DriveCopy — restore.rs's own recheck refuses unless the target is still a spreadsheet, and acquire() only ever takes a Bytes backup of a non-native target; this arm exists solely for exhaustiveness over the shared LeaseBackup enum
src/cli/drive/lease.rs	ignore	1000-1003	both	guards this test helper against misuse; every call site below passes an acquire subcommand
src/cli/drive/lease.rs	ignore	1014-1017	both	guards this test helper against misuse; every call site below passes a prune subcommand
src/drive/lease/ledger.rs	ignore	812-816	both	mutate_locked refuses before ever calling the closure, so its body never runs — a hit here is a regression, not a coverage gap
src/drive/lease/restore.rs	ignore	1137-1141	both	every test using this double refuses before authenticating; a hit here is a regression, not a coverage gap

Patch coverage

Patch: 93.02% (40/43 new lines covered)

File	Patch	Uncovered new lines
src/cli/drive/lease.rs	93.02% (40/43)	891-893

Uncovered new lines (3)

• src/cli/drive/lease.rs:891
• src/cli/drive/lease.rs:892
• src/cli/drive/lease.rs:893

_{📦 Full per-file coverage summary · run summary}