feat: plan multi-commit hotfix elevation across the env chain

[joshua-temple]

Problem

The hotfix planner handled a single commit against a single environment. The no-op (idempotency) check at the heart of Plan only consulted state.SHA ancestry; it never consulted state.Patches. A commit already applied onto a diverged env branch (recorded in patches but not advancing state.SHA) would be replanned and re-cherry-picked on every dispatch. There was also no way to elevate a set of commits across the bottom-up environment chain in one pass.

Refs #245. This is PR1 of 2; it extends the planner engine only. The generated workflow and e2e scenario land in PR2.

What changed (additive)

• parseCommitRefs parses a comma-delimited commit-ref list (trims, rejects empty/duplicate, preserves order; a single ref stays a one-element slice).
• expandTargetEnvs returns the bottom-up env sequence from the second env up to and including the target (first env and anything above the target excluded).
• The per-(commit,env) idempotency check now treats a commit as present when it is an ancestor of state.SHA OR already recorded in state.Patches. This closes the core re-elevation gap.
• The trunk-ancestry gate is factored into a per-ref loop so a mixed set fails citing the offending ref, order preserved.
• PlanChain(refs, targetEnv) returns per-env plans (env, branch, base SHA, ordered to-apply commits after skips, whole-set no-op). Commits in ref order, envs bottom-up.
• cascade hotfix plan --commits triggers the chain path with text/JSON/GHA output; the chain output keys (env_sequence, env_count, commits_<env>, no_op_<env>, conflict_expected_<env>) are additive.

The single-env Plan and PlanResult are unchanged; schema_version stays 1; no new manifest or config field.

Verification

• go build ./cmd/... ./internal/...: success
• go test ./...: 1668 passed, 27 packages
• go vet ./internal/hotfix/...: no issues
• golangci-lint run ./...: no issues