fix: eliminate eventual-consistency race in multi-env hotfix finalize

[joshua-temple]

Problem

When finalizing a hotfix across multiple environments, the second env's Finalize Hotfix step failed with "no release found for tag v1.0.0-rc.0.hotfix.2" even though the draft release existed. GitHub's GET /releases/tags/{tag} returns 404 for drafts, and the GET /releases list endpoint has a propagation window of a few seconds after draft creation, so the second env reliably lost the race while the first succeeded by chance. The live fleet caught it on v0.3.0-rc.20.

Fix

1. Thread the just-created release ID from create through to the prerelease promotion so it is used directly and never re-discovered by tag/SHA (eliminates the race for the hotfix create-then-prerelease sequence).
2. Harden the general by-tag/SHA lookup with a bounded, injectable-backoff retry before concluding "not found" (defense-in-depth).

Verification

New unit tests stub a server where the by-tag endpoint always 404s and the list is empty on the first call; the create-then-prerelease sequence now succeeds, and neutralizing prong 1 reproduces the exact "no release found" failure. The act+gitea e2e cannot reproduce this (gitea skips the prerelease PATCH path and has no list-consistency window), so the stubbed-client unit test is the regression guard. Full suite green, lint clean, schema_version unchanged. Single-env hotfix finalize path unaffected.