Adopt ConfigKit overlays for pipeline selection

docs/internal/manifest.md

@@ -23,9 +23,11 @@ portable opaque segments. Unsafe legacy identities are rejected with migration
 guidance rather than being normalized into a different workspace or remote
 namespace.
 
-Decoding is strict at every typed manifest field. Unknown fields are rejected;
-the schema version remains `narratio.session-manifest.v1` and there is no
-compatibility reader that silently drops retired state. Cleanup progress uses
+Decoding is strict at typed execution-state fields. Unknown informational fields
+inside `effective_config` are ignored so older selection labels can be read;
+unknown fields elsewhere are rejected. The schema version remains
+`narratio.session-manifest.v1` and there is no compatibility reader that
+silently drops retired execution state. Cleanup progress uses
 only the cleanup entry in `stages`.
 
 Every persisted session manifest has a non-nil `stages` map. Each entry is
@@ -306,10 +308,10 @@ after such a private content change.
 
 The session manifest is the authoritative stage-progress ledger across
 invocations. It retains the most recently resolved invocation's bounded
-configuration provenance. It identifies the selected profile name and source
-(`default` or `cli`) plus the effective configuration digest, but never a raw
-secret or profile content. This provenance is informational: it does not
-participate in stage resume or cache decisions. A profile change therefore
+configuration provenance. It identifies the selected overlay name and source
+(`explicit` when selected) plus the effective configuration digest, but never a raw
+secret or overlay content. This provenance is informational: it does not
+participate in stage resume or cache decisions. An overlay change therefore
 invalidates only stages whose semantic configuration changed. When a private
 external-tool model, module, prompt, or profile changes behind an unchanged
 configured identifier, use `--force` for the affected work.