fix(fwstate): avoid leaking maps on UpdateConfig failure after map creation

[3Hren]

UpdateConfig can leak newly created FWState maps/layers when an error occurs after CreateMaps succeeds.

Affected paths:

• modules/fwstate/controlplane/service.go
• modules/fwstate/controlplane/ffi.go
• modules/fwstate/api/fwstate_cp.c

Problem:

• UpdateConfig creates maps or inserts new layers via newConfig.CreateMaps().
• If RelinkConfigs, UpdateModules, or another later step fails, the error path calls newConfig.DetachMaps() and then newConfig.Free().
• For a brand-new config, this detaches the only owner of the newly allocated maps.
• For a resize of an existing config, this can detach the newly inserted active layers.
• The detached maps/layers are then unreachable and leak.

Expected outcome:

• Separate borrowed old maps from newly allocated maps/layers on rollback.
• Free resources created during the failed update while avoiding freeing maps still owned by the old live config.
• Add a failure-path test around UpdateConfig after successful map creation.