feat: manual rollback that deploys, arbitrary-depth and divergence-safe

[joshua-temple]

Problem

cascade rollback resolved a prior target and rewrote manifest state but never deployed, never consulted the populated history ring, and left the env on the linear promotion line. An operator could not return an environment to a prior version with a real deploy, and a rewritten-but-undeployed state could silently propagate upward.

Fix

Manual, arbitrary-depth rollback that actually deploys and is divergence-safe.

• Target resolution now reads live state, then the previous history ring (newest-first, any retained depth), then git history. --to <version|sha> is optional; with no target it defaults to N-1 from the ring (git fallback when the ring is empty).
• A new generated cascade-rollback workflow (workflow_dispatch: environment, optional target, optional deployable, dry_run) wires preflight resolves the target -> deploy-<name> redeploys the resolved SHA through the same deploy callbacks promote uses -> finalize writes state and marks the env diverged. It emits only when the manifest declares environments.
• A rolled-back env is marked diverged with a synthetic ref: rollback/<env> (plus base_sha for context) so the existing diverged-source guard blocks promoting the downgrade upward, and a later roll-forward rejoins and clears it through the existing finalize path.
• Rejoin cleanup is made safe: a rollback-origin divergence has no real integration branch, so rejoin skips branch and hotfix-release deletion (which would otherwise error on a nonexistent branch) while still clearing the divergence fields. The hotfix-divergence path is unchanged.
• Finalize honors the deployable scope, so a deployable-scoped rollback moves only that deployable and does not mark the whole env diverged.
• Composes with the existing downgrade gate: the divergence guard governs promoting from the env, the downgrade gate governs promoting a lower version onto an env; orthogonal, no double-block, no bypass.

Additive only: promote and hotfix generation are unchanged.

Verification

• go build ./..., go test ./... (1285 passing), go vet, golangci-lint run ./... clean on the main module.
• e2e/ module builds and vets clean; golangci-lint clean.
• Dogfood: generate-workflow --force then git diff --exit-code -- .github/workflows .github/actions is clean (the dogfood manifest declares no environments, so no rollback workflow emits).
• New e2e gitea scenarios under e2e/scenarios/rollback/: deploys a prior version, marks-diverged-and-blocks-upward-promote, roll-forward-rejoins-without-cleaner-error, failed-deploy-leaves-state-unchanged, and deployable-scoped-leaves-env.
• Unit coverage for ring resolution at depth 1 and >1, N-1 default and git fallback, diverged-after-rollback, rejoin-skips-branch-deletion (spy cleaner asserts zero deletions) with a hotfix regression guard, and the generated workflow shape.