fix: authenticate hotfix finalize state write with the state token

[joshua-temple]

Problem

The generated hotfix finalize job writes manifest state to the trunk branch via the Contents REST API authenticated with bare GITHUB_TOKEN (github-actions[bot]). On a repo with a require-pull-request rule on trunk, that write is rejected:

state write via API failed: "Repository rule violations found ... Changes must be made through a pull request." status 409

The promote and orchestrate finalize state writes already authenticate with the configurable state token (an admin PAT set to bypass the rule via enforce_admins=false), which is why those suites are green. The hotfix finalize was the one remaining trunk-write still on the bot token.

Audit

Every hotfix job inspected for trunk/PR-touching credentials:

Job	Operation	Token before	Token after
plan	cascade hotfix plan (read-only)	none	none (no write)
apply	gh pr create + label seed + clean merge	state token	unchanged
apply (merge step)	gh pr merge	state token	unchanged
check	cascade parse-config (read-only)	none	none (no write)
context	reads manifest, derives SHAs	none	none (no write)
finalize	cascade hotfix finalize Contents API write to trunk	GITHUB_TOKEN (bot, blocked)	state token

No remaining bare-GITHUB_TOKEN on any trunk- or PR-touching hotfix operation. The finalize step's separate GITHUB_TOKEN (release/tag API, not gated by branch protection) is intentionally left as the default, mirroring the promote finalize structure.

Fix

internal/generate/hotfix.go finalize job: GH_TOKEN now uses getStateTokenRef() (the same accessor used by apply, merge, promote, and orchestrate), defaulting to GITHUB_TOKEN when no state token is configured for back-compat.

Verification

• New unit tests (red before, green after): finalize GH_TOKEN is the configured state token, and falls back to GITHUB_TOKEN when unset.
• Existing apply/merge state-token tests remain green.
• Full suite: go build ./..., go test ./... (1414 passed), golangci-lint run ./... (clean). e2e module builds and vets clean.