fix(statewrite): preserve unmodeled config in the orchestrate and external-update state writes

[joshua-temple]

Follow-up to #350. After #371 routed the six finalize/reset/rollback sites and promote saveConfig through the yaml.Node-preserving config.WriteManifestState helper, two same-class lossy state writes remain:

• internal/orchestrate/orchestrator.go writeConfig() re-marshals the typed CICDFile (and notably UNWRAPPED, no manifest-key wrapper) after mutating only State. Routing it through WriteManifestState would both preserve unmodeled keys and change its on-disk shape to wrapped, so it needs its own investigation plus an e2e check before changing.
• internal/external/command.go writeManifest() reads into map[string]any and replaces only manifest[key], so it preserves sibling top-level keys but still drops unmodeled keys inside the ci: section.

Both should land as a focused, separately-reviewed PR with their own coverage. The helper and tests from #371 are the reusable foundation.