hotfix: follow-up items after initial capability landing

[joshua-temple]

The hotfix capability landed across #99-#106: the version segment, additive EnvState divergence fields, git ancestry primitives, promotion guard rules, the hotfix plan and hotfix finalize verbs, the generated cascade-hotfix.yaml workflow, and the divergence-end lifecycle. Documentation lands in #107.

Known follow-ups:

1. The rollback_sha output in the generated hotfix workflow is currently a disclosed placeholder. The deploy and rollback jobs mirror the promote workflow's shape; the rollback path activates once a CLI output supplies the prior SHA.
2. act/gitea e2e scenarios for the hotfix flow are pending, tracked for the e2e harness work: clean cherry-pick auto-merge, conflict resolution, finalize state write, stacked hotfix, rejoin promotion with cleanup, the promotion guard rules, prod target with environment gate, and the no-op and non-trunk-commit refusals.

[joshua-temple]

Both follow-ups are resolved. Item 1 (real rollback_sha wiring so the hotfix rollback job actually fires) shipped in #155 and is part of the broader rollback feature (#155-#158). Item 2 (act/gitea hotfix e2e scenarios) was delivered earlier in the e2e harness work: clean-apply, conflict-resolution, containment, generation-threshold, guards, prod-gate, refusals, rejoin, stacked. Closing.