fix: wire real rollback_sha into hotfix auto-rollback (#108)

[joshua-temple]

Problem

Auto rollback-on-failure works in promote but is a dead stub in hotfix. The generated hotfix workflow declares a rollback_sha output and a correctly-gated rollback- job, but the context job echoed rollback_sha= empty, so the gate (rollback_sha != "" && deploy failure) never fired. This is the placeholder noted in #108 item 1.

Fix

The hotfix context job now sources a real pre-hotfix SHA, mirroring promote (RollbackSHA = state.SHA = N-1):

• Adds an actions/checkout step (fetch-depth: 0) to the context job so the committed manifest is available.
• Reads ..state.<target_env>.sha via yq (the same pattern release.go already uses for source_sha), null-safe to "".
• Emits rollback_sha=${ROLLBACK_SHA} instead of the empty literal.

The rollback- gate is unchanged and now reachable. A first-ever hotfix into a fresh env has no N-1 SHA, so rollback_sha stays empty and the gate correctly skips - the gate is self-limiting. Hotfix auto-rollback is intentionally always-on when an N-1 SHA exists: the hotfix workflow has no preflight job to carry a rollback_on_failure signal, so wiring an explicit opt-in input is out of scope; documented in a code comment.

Release case

The release workflow tags, generates the changelog, and publishes a GitHub release. It performs no environment deploy, so there is no deploy to auto-roll-back. No rollback job is invented; the absence is documented in a code comment before writeJobs.

Verification

• New unit tests (red then green): TestHotfixGenerator_ContextEmitsNonEmptyRollbackSHA, TestHotfixGenerator_RollbackJobGatedCorrectly, TestReleaseGenerator_NoRollbackJob.
• e2e: e2e/scenarios/hotfix/hotfix-rollback-runtime.yaml asserts the generated hotfix workflow now reads state sha via yq, emits rollback_sha=${ROLLBACK_SHA}, drops the empty echo, and keeps the rollback gate intact. A live failed-deploy simulation is not stageable through the cherry-pick to PR to merge to deploy flow on the act harness, so this is the generator-output contract (same approach as 13-inline-run-deploy-no-rollback.yaml).
• go build ./..., go test ./..., golangci-lint run ./... all clean; e2e module builds and vets clean.
• Dogfood workflows: regenerating from the repo manifest produces no drift (the manifest declares no environments, so the hotfix generator is disabled for it).

Addresses #108 item 1 (the hotfix rollback_sha placeholder). Additive and non-breaking: promote rollback behavior is unchanged.