fix: make hotfix finalize fully trunk-based (read and write)

[joshua-temple]

Problem

Hotfix finalize was not trunk-based on either the read or the write side, and the write side caused data loss.

• Read: finalize read the prior env state from the checked-out manifest. On the pull_request closed run that tree is the env branch, which lags trunk because promote writes env state only to trunk. The target env recorded a stale or absent state SHA, so finalize failed with "environment has no recorded state SHA".
• Write: finalize then serialized the checked-out env-branch manifest and PUT it to trunk. The env-branch manifest lags trunk for every env (empty post-reset in a 3-env setup), so writing it to trunk wiped the non-target envs' recorded trunk state.

Fix

Finalize now treats the trunk manifest as the single source of truth for both halves:

• It reads the trunk manifest once (Contents API on real GitHub, plain git under act/gitea).
• It uses that trunk manifest as the write basis, mutates only state[targetEnv] with the hotfix result (merge SHA, version, patches, base SHA, substates), and writes that manifest back to trunk.
• Every other env's recorded trunk state is preserved. The merged code SHAs still come from the --fix-sha/--base-sha/--merge-sha inputs.

Verification

• TestFinalize_ReadsPriorStateFromTrunk / TestFinalize_TrunkIsSourceOfPriorState guard the read.
• TestFinalize_DoesNotClobberOtherEnvsTrunkState guards the write: trunk has populated state for all envs while the env-branch manifest is stale/empty; after finalize, the target env is updated and the other envs retain their trunk SHAs. Red before the write-basis change, green after.
• go build ./... && go test ./... (1412 passed) && golangci-lint run ./... (no issues). e2e module builds and vets clean.