fix: the remaining findings of the main audit

[alexey-igrychev]

The rest of the audit of main, one commit per finding.

• commands are rendered with html/template, so values are HTML-escaped #23 — commands, hooks and env values were rendered with html/template, so v1.0.0+build.3 reached sh as v1.0.0+build.3. HTML escaping protects nothing in a shell context.
• {{ .RepoCommit }} is the tag object hash for annotated tags #24 — GetLastSemverTag returned the reference hash unpeeled, so {{ .RepoCommit }} was the hash of the tag object for annotated tags, which is what signed releases use.
• env names from the repository config reach the command in lower case #19 — viper lower-cases keys; only one of the two config paths upper-cased them back, so a repository trx.yaml with env: {FOO: bar} reached the command as foo=bar. The rendering is in one helper now, mergeEnvs no longer writes into the operator config, and the operator config overrides the repository one as documented.
• a quorum without a name panics #20 — the optional name of a quorum was dereferenced during verification and panicked inside an errgroup goroutine.
• ignored errors from user.Current, HostLocker and ssh key read cause nil dereferences #26 — a failing lock.HostLocker left a nil locker that panicked on Acquire, and an unreadable ssh key produced an error naming neither the file nor the cause.
• README config example does not load: 'repo' has invalid keys: commands, env #18 — the README example nested commands and env under repo, so copy-pasting it failed with 'repo' has invalid keys: commands, env. A test now loads the example straight out of the README.
• minor: log format bugs, dead code and dead config fields #29 — four WARNING lines printed the literal %w, the quorum hook was reported as onCommandSkipped, onCommandStarted logged itself as onStartedSuccess, and the quorum name was dropped from the error the operator sees. Dead code removed with it: command.Vars, StorageOpts.StorageType, initial_last_published_git_commit, the unreachable _default(), and a branch of IsNewerVersion covered by the preceding comparison.
• last processed tag: non-atomic write, and a store failure after a successful release #21 — the state file was truncated and rewritten in place, so a crash could leave v1. behind and fail every later run. It is written to a temp file and renamed, and the directory is synced.
• clone and fetch have no timeout, and an interrupted clone is never repaired #27 — clone and fetch took no context and no timeout while the execution lock was held. Both are bounded (15 min), the clone goes through a temp directory, and a directory left by an interrupted clone is removed and cloned again instead of failing forever.
• SIGTERM kills only sh, orphans the workload and prevents failure hooks #25 — SIGTERM killed sh and left the workload running as an orphan outside the lock, while the cancelled context made every hook fail instantly with context canceled. The command runs in its own process group, the group is signalled and then killed, hooks run on a context derived without the cancellation, and a second Ctrl-C ends trx at once.

Two more findings filed under #29 as "worth a second look", both promoted because they change what gets deployed:

• semver sorts v2.0.0-rc1 above v1.9.0, so a release candidate became the newest tag and was deployed as a release. Pre-releases are skipped unless repo.allowPrerelease is set.
• a forced checkout leaves untracked files in place, so build artifacts and stray .env files of the previous release took part in the next deployment. The worktree is cleaned.

Behaviour changes for operators

• repo.env no longer overrides the operator env — the README always documented the opposite.
• Pre-release tags are not deployed unless repo.allowPrerelease: true.
• The worktree is cleaned on checkout; gitignored files survive, as with git clean -fd.
• An interrupted run is no longer recorded as a failed tag, so it is retried without --force.

Closes #18, closes #19, closes #20, closes #21, closes #23, closes #24, closes #25, closes #26, closes #27, closes #29.