fix: preflight template pin targets

[itzptk]

Summary

• rejects cask template runs containing pin/unpin steps before registering parent jobs or mutating Homebrew
• unregisters template parent job metadata in a finally block after success, false-result failures, or thrown step failures
• expands template runner coverage for cask pin/unpin preflight and parent cleanup paths

Closes #6
Closes #9

Verification

• npm run test:node -- electron/services/action-template-runner.test.ts
• npm run test:node
• npm run build
• independent code review: passed; follow-up suggestions for cask unpin and thrown-step cleanup coverage were added and reverified