feat(cli): ferrflow shadow-release — full pipeline dry-run against a clone

[BryanFRD]

Problem

End-to-end release runs currently require either pushing to a real repo or scaffolding a disposable fixture by hand. There's no built-in "show me what would happen, for real, without touching anything" mode that exercises the full pipeline — config load, changelog build, version file write, tag creation, forge release — against a live-but-scratch repo.

The --dry-run flag today stops short of the side-effecting steps. Useful, but doesn't build confidence that the full pipeline would succeed once dry-run is off.

Proposal

New subcommand ferrflow shadow-release:

• Clone the current repo into a temp dir.
• Run the full release pipeline against that clone, end to end:
  • Compute versions.
  • Write updated version files (in the clone).
  • Write changelog entries (in the clone).
  • Create the tag (in the clone).
  • Optionally push to a configurable SHADOW_REMOTE (defaults to disabled — if set, push to a dedicated shadow/ branch of the remote for inspection).
• At the end, print a summary: what would have changed, what files got written, what tags got created.
• Delete the temp dir unless --keep is passed.

Benefits:

• Catches pre-publish hook failures without actually publishing.
• Surfaces post-write state that --dry-run only simulates.
• CI can gate merges on ferrflow shadow-release --fail-on-warnings passing.

Acceptance

• Running on a real repo produces the same filesystem state in the clone as a real release would, minus the push/publish.
• Exit code is 0 when everything succeeds, non-zero with a specific error code when any step fails.
• The original repo is untouched.
• --keep preserves the temp dir and prints its path for inspection.

Out of scope

• Simulating forge API responses without calling them (too much surface area; users can simply not set GITHUB_TOKEN to skip the forge step).
• Running against multiple branches in parallel.