Fix runner workspace default branch resolution

[chubes4]

Summary

• Preserve explicit runner_workspace.base precedence and the base_branch compatibility alias.
• When neither is set, resolve the target repository default through the existing authenticated GitHub REST helper and apply the existing branch-safety contract.
• Reject missing or invalid metadata defaults with a clear error.

Source Evidence

• Source relationship: issue Resolve omitted publication base from repository default branch #1864 identifies the generic runner-workspace GitHub publisher defaulting to main instead of the target repository default branch.
• Change kind: bounded runtime branch-resolution correction plus deterministic publisher tests.
• Verification capability: mocked authenticated REST calls verify explicit and alias paths skip metadata, metadata-derived non-main branches publish correctly, and missing/unsafe metadata fails before publication.
• Scope: the runtime change only replaces the omitted-configuration main fallback; configured branch behavior, alias support, API authentication, and the established branch predicate are retained.

Tests

1. npm run test:runner-workspace-publisher
2. TMPDIR=/tmp npm run test:agent-task-contracts

Compatibility

Configured runner_workspace.base remains authoritative and base_branch remains supported. Unconfigured publishers now target each repository metadata default branch rather than assuming main.

Fixes #1864

AI Assistance

Assisted by OpenAI openai/gpt-5.6-terra.