docs: document hotfix capability

[joshua-temple]

Problem

The hotfix capability has no user-facing documentation. The workflows.md hotfix section was a stale stub that referenced a placeholder issue number and described the pre-capability behavior.

Changes

• docs/workflows.md: replaces the stub with full hotfix documentation covering the trunk-first roll-forward default, per-environment env/<env> integration branches, the cherry-pick and resolution-pull-request flow, conflict UX (markers committed, force-push to resolve), rejoin and cleanup, and the generated cascade-hotfix.yaml workflow (triggers, jobs, prod environment gating, env/* protection suggestions).
• docs/versioning.md: adds the hotfix version segment, documenting both shapes: nested vX.Y.Z-rc.N.hotfix.M for rc-based bases and a normal patch bump for published bases.
• docs/cli-reference.md: adds hotfix plan and hotfix finalize command references with flags, inputs, and outputs matching the implementation.

Verification

• grep -riE 'cfa|dxe|delivery' docs/ returns clean.
• Markdown well-formed; internal same-directory links resolve and match the existing convention.