refactor(package-firewall): extract the managed-file writers, and back up before clobbering

fix: a whole-file write no longer destroys a hand-tuned config

upsertPackageFirewallConfigFile backed up only when merging. A Structured write —
~/.m2/settings.xml, ~/.nuget/NuGet.Config, ~/.composer/config.json — replaced the
user's file outright with no .bak, and uninstall then deleted it. Every write that
changes existing content now backs it up first, and a removal restores the backup
rather than deleting a file it did not create.

The writers move to internal/managedfile with the block markers as a parameter.
That is not cosmetic: the AI Firewall writes to the same ~/.zshrc, and with the
markers as package-level constants `package-firewall uninstall --all` would strip
its block out from under it.

A managed block deliberately gets no backup: removal is surgical, and restoring a
stale backup would discard edits the user made after install.

Author: 0x73746F66