feat(e2e): add hotfix runner step actions and expectation surface

[joshua-temple]

Problem

The multi-step e2e harness lacked the step actions and assertion surface needed to drive the hotfix flow end to end. Hotfix scenarios could not stage a diverged environment, run the plan job, drive a harness-side cherry-pick/PR/merge cycle, exercise the merged build/deploy/finalize path, or assert divergence state (ref, base SHA, patches) and branch/PR outcomes.

Fix

Additive harness capabilities (no existing scenario or step type is affected):

• New step actions: hotfix_plan (commit_ref, target_env, dry_run, expect_failure), hotfix_apply (target_env, commit_ref), merge_pr (label/index), resolve_conflict (files), hotfix_merged (target_env). Validated in the runner switch and dispatched to new execute methods. hotfix_apply runs a real git cherry-pick -x in the act container, distinguishes clean vs conflict from the unmerged-file list, opens a gitea PR with the cascade-hotfix / cascade-hotfix-conflict label and the machine-readable trailers, and polls the pushed branch SHA before opening the PR.
• Expectation surface: StateExpect gains ref, base_sha, patches, patches_contain, previous_version; StepExpect gains branches (exist/deleted) and prs (open_with_label/open_count). EnvStateSetup gains ref/base_sha/patches/previous_version so a diverged env can be staged directly without a full hotfix run. PromoteStep gains force, mapped to the promote workflow's force input.
• State assertions read the product manifest divergence keys (ref, base_sha, patches) and the harness materializes them into the staged manifest.

Verification

• go build ./... and go vet ./... clean at the repo root and in the e2e/ module.
• golangci-lint run ./... clean (root and e2e module).
• Harness unit tests (parsing, validation, dispatch wiring, state assertions) pass without Docker.
• Regression with Docker: TestMultiStepScenarios/Two_Environment_Happy_Path and Three_Environment_Happy_Path both pass.

This is an enabler for the hotfix scenario suite; it adds harness capability only and ships unit coverage for the new parsing, validation, dispatch, and assertion wiring.