feat(cli): add shadow-release to run the full release in a throwaway clone

[BryanFRD]

Closes #366

ferrflow shadow-release [--keep] clones the repository into a temp dir and runs the real release pipeline there: versioned files, changelogs, release commit, tags, floating tags, and the pre-commit to pre-publish hooks. It stops before anything leaves the machine: no push, no forge release, no draft promotion, no post-publish hooks, no publishers. It then prints the commits, files and tags it produced.

• A shadow flag on RunFlags/ReleasePlan cuts the pipeline after pre-publish hooks, skips bot-authored commits and pending drafts, and forces a local commit in pr mode so the clone shows the post-merge state.
• The clone's push URL points at an empty bare repo in the temp dir, so even a stray push cannot reach the source or its remote.
• The source repo's identity and signing settings are copied into the clone, since repo-local git config does not survive a clone.
• New error code E2016 when the clone itself fails; any other failure keeps the failing step's code.

Left out on purpose: the SHADOW_REMOTE push and --fail-on-warnings from the issue. Neither is in the acceptance criteria, and both can come later if someone asks.

Checked by running it on this repo: it computed v7.26.14, wrote 13 files, created the tag, and left the local refs untouched.

[ferrfleet]

One blocking finding: onSuccess / onError still run for real in shadow mode (see inline). The rest looks right. The clone is isolated: pushes go to the sink and the forge, drafts and publishers are skipped.

[ferrfleet]

94ef80a fixes the onSuccess / onError finding. Publisher::release now returns before either hook in shadow mode, and the new marker test covers it. Nothing new is blocking.