fix: use null-safe github.event.inputs.dry_run in orchestrate deploy passthrough

[joshua-temple]

Problem

The orchestrate generator passed the dry-run flag to a supports_dry_run deploy callback as dry_run: ${{ inputs.dry_run }}. orchestrate.yaml is triggered by push, schedule, and workflow_run, none of which populate the inputs context, so the bare expression renders an empty string. The deploy callback declares dry_run as type: boolean, and passing an empty string into a boolean reusable-workflow input fails the dispatch with no visible job. Finalize then sees the deploy as failed and on_failure aborts. Only repos with a supports_dry_run deploy callback hit this; the four-environment example was the trigger.

Fix

internal/generate/generator.go now emits dry_run: ${{ github.event.inputs.dry_run }}, the same null-safe accessor already used everywhere else in the generator (promote and release deploy passthroughs, every dry_run guard). On push/schedule/workflow_run it renders null so the callback boolean falls back to its default; on dispatch it forwards the operator value.

A test in internal/generate/dry_run_test.go had locked in the broken bare form, contradicting the corrected assertions elsewhere in the same file. Both assertions now expect the null-safe accessor.

Verification

• go build ./... and go test ./... (1391 tests) pass
• golangci-lint run ./... clean in both the root and e2e modules
• Regenerating cascade own workflows produces no drift (its manifest has no supports_dry_run deploy callback)
• New e2e scenario e2e/scenarios/orchestrate/dry-run-input-expression.yaml asserts the generated orchestrate.yaml uses the null-safe accessor and never the bare form; the harness deploy stub now declares a boolean dry_run input so the passthrough is exercised