Problem

A routine chore: update state for <env> [skip ci] state-write dropped the cli_version_sha field from a pin_mode: sha manifest, leaving SHA-pinned setup-cli refs with no manifest pin (permanent drift). Root cause: cascade binaries that predate the introduction of the cli_version_sha struct field discard the unmodeled YAML key on the orchestrate writeConfig typed re-marshal. The node-surgery WriteManifestState path (already on main) is the correct fix and preserves the key even on a binary that never modeled it, so no production code change is required here.

Fix

• Regression coverage that pins the bug-and-fix contract: the typed re-marshal drops an unmodeled key while WriteManifestState preserves cli_version_sha and the surrounding state wrapper.
• A new e2e scenario that drives a pin_mode: sha repo carrying a populated cli_version_sha through a routine dev state-write and asserts the manifest still declares the field, the generated workflows stay consistent, and regeneration is idempotent.
• Restore the example-repo SHA-pin in the fleet repin (revert of the earlier tag-pin workaround), so the only pin_mode: sha fleet repo again exercises SHA-pinning end-to-end. This is drift-safe now that repinned binaries carry the node-surgery state-write.

Verification

• go build ./..., go test ./... (full suite), and golangci-lint run ./... all pass.
• The e2e scenario runs green locally under Docker.
• Merged up to current main; the repin keeps the broadened stale-ref rewrite and the restored SHA-pin together, with the workaround removed.

Closes #390.