fix(tekton): resolve optional hooks deterministically

[jmjava]

Summary

• replace empty optional remote-hook names with an installed tekton-dag-hook-noop sentinel
• keep hooks skipped unless a real hook Task name is configured
• align the E2E clone Secret with the operator-generated PipelineRun workspace
• fail product-path polling immediately when the underlying PipelineRun is terminally failed

Root cause

Both backends reached bootstrap, then Tekton rejected the Pipeline because cluster-resolver Task names were empty. Tekton resolves remote TaskRefs before evaluating when, producing CouldntGetTask: missing required cluster resolver params: name. The run then wasted 35 minutes because the StackRun exposed that Tekton reason instead of the small hard-coded terminal phase list.

Verification

• shell syntax, Ruff, and YAML parsing: passed
• focused hook/intercept tests: 7 passed
• Helm lint: passed
• prescribed local regression: regression exit code: 0
• fresh Telepresence/mirrord matrices are running