fix(generate): enforce emitted-workflow validity; reject on_failure continue, gate hotfix inputs

[joshua-temple]

Problem

Emitted workflows are actionlint-checked in CI only over the e2e scenario outputs, which exercise almost none of the documented manifest surface. So a documented feature could emit a workflow real GitHub rejects at parse while every scenario stayed green. Two such defects were confirmed:

• on_failure: continue emitted continue-on-error: true on a reusable-workflow-call job (jobs.<id>.uses). GitHub forbids that key on a uses: job, so the whole orchestrate workflow was rejected at parse.
• hotfix build passed sha and target_env unconditionally in its with: block. GitHub rejects a reusable-workflow call with undeclared workflow_call inputs, so every hotfix build failed at parse.

Fix

• New guard TestActionlint_FeatureMatrix: generates the full workflow set for a matrix over the documented emitted-affecting manifest surface (on_failure, hotfix inputs, build matrix, deployments, rollback dispatch, retries, cancel_in_progress, components) and runs actionlint over every emitted file. Extensible by adding a row.
• on_failure: continue is rejected at config validation. A tolerated failure cannot be expressed for a reusable-workflow-call job, so cascade refuses it loudly rather than emit invalid YAML; abort (the default) is the only supported value. The generator no longer emits continue-on-error under any input.
• The hotfix build with: block now gates each input on the callee's declared workflow_call inputs, mirroring the orchestrate path; a callee that declares neither gets no with: block.
• Adds an e2e scenario exercising the on_failure field (no prior scenario set it), updates the manifest JSON schema (all three copies) and the reference docs, and records the byte-identical hotfix churn in CHANGELOG.

This closes the LOUD enforcement gap: cascade never emits a workflow real GitHub rejects at parse; it either expresses the feature correctly or rejects the config loudly.

Verification

• Guard proven RED on both defects, then GREEN after the fixes (11/11).
• go build ./..., go test ./... (3459), go test ./... -race (3459), golangci-lint run ./... all clean.
• e2e module: go build + go vet clean; new scenario passes discovery, schema, and integrity.
• cascade verify --own-repo: no drift. Schema copies byte-identical.
• Golden churn is confined to the hotfix workflow's build with: blocks (undeclared sha/target_env removed); every other surface is byte-identical.

FLEET-RELEVANT (changes generated output).