feat(hotfix): record per-component finalize state and scope hotfix tags

[joshua-temple]

Problem

The hotfix finalizer records state via a whole-flat-node rewrite, so on a multi-component manifest a concurrent hotfix on one component would drop a sibling's state.components.* under the CommitWithRetry 409 re-apply. Hotfix tags are also not component-namespaced.

Fix

• The hotfix finalizer gains a component (threaded from --component). When set, it overlays the component's persisted rows, re-applies the hotfix, and node-patches only state.components.<name>.<env> via WriteScopedState, preserving sibling subtrees. Empty component keeps the flat WriteManifestState path, byte-identical.
• Hotfix tags resolve through the component's tag grammar (strict prefix), so a hotfix tag is created and looked up in the component's namespace and never cross-matches a sibling.
• The finalizer records env/<component>/<env> for a component, env/<env> otherwise.

Scope is finalize state, tag scoping, and the env-branch name inside finalize. The promote rejoin cleanup and the generator emitting --component on the hotfix step are separate changes; until the generator wiring lands, the component path is inert.

Verification

go build ./..., go test ./... (2624 pass), go test -race on hotfix+config (677 pass), golangci-lint run ./... clean; single-component byte-identical baseline gate green. The load-bearing concurrency test TestHotfixFinalize_ConcurrentFinalize_SiblingSurvivesThrough409Reapply drives the real hotfixMutation -> CommitWithRetry path: a 409-once fake injects a concurrent sibling's subtree; this component's node lands while the sibling survives verbatim including an unmodeled key. A byte-identical single-component test proves the empty-component mutation equals the direct WriteManifestState reference.

Refs #293.