pub fn set_fail_closed_marker(on: bool) -> Result<()>Expand description
Create or remove the fail-closed marker to match on. Best-effort, atomic
create; called by the admin flow when the locked fail_closed setting
changes so the posture survives a daemon restart and a kill.