feat(hotfix): add finalize verb writing diverged state, tag, and release

[joshua-temple]

Problem

A merged hotfix resolution leaves the integration branch ahead of the recorded
environment state. Nothing yet writes the diverged state back to trunk, mints the
hotfix version, or creates the release object, so the environment cannot rejoin
the pointer model cleanly.

Fix

Adds cascade hotfix finalize to the internal/hotfix package. After the
resolution PR merges and the build and deploy succeed, the verb:

• cross-checks the merge SHA equals the env/<target> branch tip (fails on drift)
• allocates the next free hotfix version: a nested vX.Y.Z-rc.N.hotfix.M segment
  for rc-based versions, or a reconciled patch bump (skipping existing tags) for
  published bases, so it never collides with the normal release sequence
• snapshots the prior env state into the previous rollback ring (its first
  producer) and writes sha/version/ref/base_sha/patches/committed_* plus the
  build and deploy substates
• carries base_sha forward and appends to patches when stacking a second hotfix
• commits the manifest to trunk with the shared rebase-retry push and the
  [skip ci] convention
• creates the hotfix tag and release object via release.Manage with a body
  recording the base version and the carried trunk commit; prerelease-env targets
  promote the release to a GitHub prerelease

The verb is idempotent on identical inputs: a rerun after the state already
records the merge SHA is a no-op (no double-applied patches, no re-snapshot).

A companion refactor extracts promote's commit-and-push-with-rebase-retry into
internal/git (CommitAndPushWithRetry, plus ListTags); promote delegates to
it so its behavior is unchanged and its existing tests stay green.

Adds regression tests in internal/release proving the RC tag and draft cleanup
paths (parseRCTag, cleanupRCTags, cleanupStaleDrafts) ignore hotfix tags.

Verification

• go build ./...
• go test ./... (1107 passing across 20 packages)
• go test -race ./internal/hotfix/... ./internal/release/...
• golangci-lint run ./internal/hotfix/... ./internal/release/... ./internal/promote/... ./internal/git/... (no issues)
• e2e module builds (cd e2e && go build ./...)

Coverage is unit tests plus committed scratch-repo and release-stub integration
tests (plan, manual merge, finalize end to end). The act/gitea e2e for the hotfix
flow, including finalize, lands in the e2e harness unit per the implementation
plan; this PR does not wire the verb into a generated workflow yet.