fix(generate): emit valid finalize flags in hotfix workflow

[joshua-temple]

Problem

The generated cascade-hotfix.yaml finalize job (introduced in #106) invoked:

cascade hotfix finalize --target-env ... --sha <merge_commit_sha>

But cascade hotfix finalize defines no --sha flag. It requires --merge-sha, --fix-sha, and --base-sha (all MarkFlagRequired). The finalize job therefore failed at runtime with an unknown-flag / missing-required-flag error. The plan job also declared outputs (hotfix_version, expect_conflicts) that the planner never writes; the real GHA keys are hotfix_version_candidate and conflict_expected, so those job outputs resolved to empty.

Fix

• Finalize now passes the correct required flags: --merge-sha from the merge commit, and --fix-sha/--base-sha recovered by the context job from the resolution PR-body trailers (Cascade-Hotfix-Source / Cascade-Hotfix-Base stamped by the apply job). The plan job does not run on the merged pull_request event, so its job outputs are unavailable on that path; the trailers are the carrier.
• Plan job outputs corrected to the planner's actual GHA keys and fix_sha exposed.
• Context job grouped its $GITHUB_OUTPUT writes into one redirect to keep shellcheck clean.

Tests

• New cross-check regression test parses every cascade hotfix <subcommand> --flag from the generated YAML and asserts each flag is a real registered flag on that subcommand's cobra command, built from the same constructor the CLI uses. It fails against the old --sha bug and passes after the fix, guarding the whole class of generated-flag-mismatch bugs.
• Added assertions for the required finalize flags, the SHA threading, and that plan-job output references match the planner's keys.

Verification

• go build ./... ok
• go test ./... 1151 passed
• go test -race ./internal/generate/... ./internal/hotfix/... green, including the actionlint test over the generated workflow
• golangci-lint run ./internal/generate/... ./internal/hotfix/... no issues

cascade's own tree declares 0 environments, so it emits no hotfix workflow; nothing to regenerate.