fix(cluster): keep JSON output valid on pinned-version upgrades

> 🤖 Generated by the Agentic Engineer

`ksail cluster update --output json` documents a machine-readable output mode for CI and MCP consumers. On the non-EKS update path a pinned-version upgrade writes a human-readable confirmation to the same stream as the JSON document, so stdout is no longer parseable.

## Where it happens

`runVerifiedProvisioner` (`pkg/cli/cmd/cluster/orchestrator.go`) reconciles versions *before* it renders the diff:

1. `reconcileClusterVersions` → `reconcileDistributionVersion` / `reconcileKubernetesVersion` → `executePinnedUpgrade`, which on success writes `" upgraded to pinned version "` to `cmd.OutOrStdout()`.
2. The flow then continues to `displayChangesSummary`, which in JSON mode emits the diff document to that same stream.

Result in JSON mode: plain text precedes the top-level JSON value, so a consumer parsing stdout fails. `reportPinnedUpgradePreamble` writes to stdout on the same path and should be checked alongside it.

## Expected behaviour

With `--output json`, stdout carries exactly one JSON document. Human-readable progress and confirmation text is either suppressed or represented inside the structured response — matching the convention `reportDryRun` already follows, and the fix applied to the EKS path in #6930 (`reportEKSUpgraded` returns early in JSON mode).

## Acceptance criteria

- A pinned distribution-version upgrade and a pinned Kubernetes-version upgrade each leave stdout parseable as a single JSON document under `--output json`.
- Text mode still confirms the upgrade to the user.
- A test covers both states for at least one pinned dimension, ablated against the current code so it demonstrably fails there.

## Notes

Found while fixing the equivalent defect on the EKS path in #6930. This one predates that PR and lives on a different code path, so it was deliberately not folded into that change. Affects only the JSON output mode; text mode is correct today.

Rough size: small — the fix mirrors `reportEKSUpgraded`, and the work is mostly locating every stdout write on the pinned-upgrade path.

Start in pkg/cli/cmd/cluster/orchestrator.go at runVerifiedProvisioner, then trace reconcileClusterVersions, executePinnedUpgrade, reportPinnedUpgradePreamble, and displayChangesSummary. Compare the JSON-mode behavior with reportDryRun and the EKS fix in #6930. Done means both pinned upgrade paths produce one parseable JSON document while text mode still confirms the upgrade, with regression coverage for JSON and text behavior.

Written by the indexing model from the issue text.