feat(hooks): expand hook points — pre-tag, post-tag, pre-release, on-success

[BryanFRD]

Problem

`src/hooks/point.rs` currently exposes `PreBump` / `PostBump` / `PreCommit` / `PrePublish` / `PostPublish`. Several useful insertion points are missing:

• `PreTag` — runs after the release commit is created but before `git tag` lands. Use case: sign tags with a different identity than the commit, run smoke tests against the bumped binary before committing to the tag.
• `PostTag` — runs after the tag is created but before the push. Use case: `cargo publish` to crates.io between tag and push (so if publish fails, the local state is recoverable; rolling back a tag locally is trivial vs after push).
• `PreRelease` (PR mode) — runs after the release PR opens but before any merge. Use case: post a Slack notification, run cross-repo validation.
• `OnSuccess` distinct from `PostPublish` — fires only at the very end after the forge release exists. Today PostPublish fires per-package; OnSuccess would fire once per ferrflow invocation. Use case: trigger a downstream deployment dispatch.
• `OnFailure` — fires when any hook or git op errors. Currently `on_failure: continue` exists at config level but no hook point exists to react. Use case: post a Slack alert with the error code link.

Proposal

Extend the enum:

```rust
pub enum HookPoint {
PreBump, PostBump,
PreCommit, PostCommit,
PreTag, PostTag,
PrePublish, PostPublish,
PreRelease, OnSuccess, OnFailure,
}
```

Document each in `docs/configuration/hooks.md` with the exact context env (which `FERRFLOW_*` vars are populated at that point). `OnFailure` should get an extra `FERRFLOW_ERROR_CODE` env var.

Backward compat

Existing `HookPoint` variants keep their semantics. The trigger order in `src/monorepo/run/mod.rs` already has natural insertion slots for the new points (between commit and tag, between tag and push, etc.).

Test plan

• Fixture: hook at `pre_tag` that exits 1 → release commit exists but no tag is created
• Fixture: hook at `post_tag` that runs `cargo publish --dry-run` → publish dry-run runs before push
• Fixture: hook at `on_failure` after a forced git push failure → assert fires with error code

Related #292 (rich context for JS function hooks).