cascade-hotfix.yaml's build-app job doesn't pass the environment input

[joshua-temple]

What's wrong

The generated `cascade-hotfix.yaml`'s `build-app` job calls a callback declaring the standard `environment`/`sha`/`dry_run` contract, but only passes `sha`:

```yaml
build-app:
uses: ./.github/workflows/build-app.yaml
with:
sha: ${{ github.event.pull_request.merge_commit_sha }}
secrets: inherit
```

`orchestrate.yaml`'s own call to the same callback passes both, correctly:

```yaml
uses: ./.github/workflows/build-app.yaml
with:
environment: ${{ github.event.inputs.environment || 'dev' }}
sha: ${{ needs.setup.outputs.head_sha }}
secrets: inherit
```

If a downstream callback declares `environment` as `required: true` (matching the documented standard contract: "Cascade always passes these to validate, build, and deploy callbacks"), a real hotfix PR merge fails at runtime with "Input required and not supplied: environment" -- caught by `actionlint`'s `workflow-call` check, not by any existing test.

How I found it

Adopting cascade in `cfacorp/voice-ordering` (PR #456 landed the callbacks, in-progress manifest PR generates hotfix/rollback). Ran `actionlint` against the generated files as a sanity check before opening the PR.

Suggested fix

Thread the resolved target environment into the hotfix `build-app` job's `with:` block, matching `orchestrate.yaml`'s pattern. The `context` job already resolves `target_env`, per its own outputs (`target_env`, `fix_sha`, `base_sha`, `rollback_sha`) -- `environment: ${{ needs.context.outputs.target_env }}` should be a direct fix.