also merge hotfixes into master when they're finished

Looks like release finishing was working correctly, but hotfix finishing was only merging into production.
I added a :secondary_destination rather than mimicking release's :destination because it updates from :destination before finishing, and updating a hotfix from master before finishing would be bad.