A synced data.json with a raw private address stays raw on disk until the next save #488

When an external change (sync) brings a data.json that contains a raw private feed address, for example one written by a device still on 2.21.1, PodNotes protects the address in memory but leaves it raw on disk until its next save.

Seen in: FIX481 (#487) probe A on Obsidian 1.14.4, Linux. The adoption path outside a save was traced in source on master, not reproduced there at runtime.

Impact: low. The raw address was already on disk, written by the other device. It stays there a little longer than it has to, until any later PodNotes save (a playback checkpoint, any setting change) replaces it.

Expected: when adoption protects a raw private address, schedule one save, so the protected form reaches disk promptly. Use the normal writer and its refusal rules (#470), and never write over an unread file.