I did a little more digging and found that the web application populates the file /Configuration/GlobalizationConfiguration.xml when adding additional languages via the web UI. But that file contains only the ISO codes, not the display names used in the UI controls.

The sorting suggestion is a little less important now, because I can order the entries in that file any way I need to. Automatic ordering would be nice, but I have a suitable workaround.

As for the display names for the languages getting modified, I think my situation is different than you describe. When I first enter the languages, they appear as I entered them. This leads me to assume that they are correct in memory on the server. When I reset IIS and go back to the list of languages, they are changed. This leads me to believe that the data in the database is not exactly how I entered it.