fix: complete hotfix-rejoin cleanup for published releases

[joshua-temple]

Problem

An adversarial audit (prompted by recurring one-per-rc fleet failures) found the hotfix rejoin/finalize cleanup path could wedge or leak objects:

• A hotfix on the prerelease env promotes its release to a non-draft prerelease; a later superseding promote's rejoin cleanup hit the general "cannot delete non-draft" guard and aborted finalize, so target state never landed.
• On a release-delete error the loop still deleted the tag, orphaning a tagless release no rerun could resolve.
• A half-completed multi-env rejoin could strand the remaining envs and wedge an already-persisted state write.

Fix

• Add a scoped AllowPublishedDelete opt-in used only by rejoin cleanup; the general delete guard for normal published releases stays in force.
• Delete the release first and only delete the tag on success; pass the env SHA as a lookup fallback for an already-tagless orphan.
• Make cleanup of disposable objects best-effort with loud warnings; reserve hard-fail for state writes, so a finalize never wedges and a rerun reconciles.
• Harden the release lookup (prefer an exact tag-match over a stale SHA-only draft) and make a partial publish rerun converge via the semver tag.

Verification

Full unit suite (1725 passed), golangci-lint clean, e2e module builds/vets, and a new hotfix-rejoin-prerelease-supersede e2e scenario exercises the prerelease-env supersede/rejoin. The general delete guard is proven intact by a negative test. schema_version unchanged; no manifest field; no generated-workflow change.

A confirmed same-rc-base cross-env cleanup scoping gap is documented for a focused follow-up (the env SHA is already plumbed for it).