Problem

Multi-environment repos need a generated workflow to hotfix a trunk fix onto a diverged intermediate environment. The pieces existed in the CLI (cascade hotfix plan/finalize, divergence state, promotion guards) but nothing emitted the orchestrating workflow.

Fix

New HotfixGenerator renders .github/workflows/cascade-hotfix.yaml, wired into generate-workflow beside the other auxiliary generators. It emits only when two or more environments are configured (below that, direct promotion already covers every case); target_env is the configured environments minus the build target.

Two triggers in one file: workflow_dispatch (inputs commit, target_env choice, pr_number replay, dry_run) and pull_request: types: [closed] on env/*, gated on merge plus the cascade-hotfix label. Jobs: plan, apply, check, context, build, deploy, rollback, finalize, with concurrency: hotfix-<env>.

• Clean cherry-pick: push, open a labeled PR, enable auto-merge.
• Conflict: commit the markers, open a cascade-hotfix-conflict PR with the conflicting-file list, resolve-locally instructions, and machine-readable trailers (Cascade-Hotfix-Target/Source/Base).
• The deploy job binds the GitHub environment: of the target env so org protection rules gate production hotfixes.
• A non-failing branch-protection check warns when env/* has no required status checks and prints the exact configuration command.
• Plan protection suggestions surface as notices.
• finalize runs only on deploy success.

Verification

• go build ./... clean
• go test ./... clean (17 new golden tests in internal/generate, including an actionlint pass over the generated output)
• go vet ./... clean
• golangci-lint run ./internal/generate/... reports 0 issues
• actionlint runs clean over the emitted workflow

Notes

• cascade's own manifest defines no environments, so the generator correctly emits nothing for this repo; there is no committed cascade-hotfix.yaml to regenerate.
• rollback_sha sourcing is left as a placeholder output; the rollback job shape, environment binding, and with: sha plumbing mirror the promote workflow and activate once a CLI output supplies the value.
• The act/gitea hotfix end-to-end scenarios are owned by a separate unit and are intentionally not added here.