A CLI-desired link relinks at startup in its stored mode, so turning
exposure off from Settings came back as a managed tunnel after restart.
Relay config applied by a client now rewrites that mode (publish_only
without a runtime, managed with one) under the link-state lock, and
only when the CLI asked for the link.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>