fix(github): avoid fork PR branch checkout collisions

[riverpilot]

Summary

• Fetch fork PR heads into a namespaced remote-tracking ref instead of refs/heads/<headRefName>.
• Check out fork PR heads detached so their-fork:main -> upstream:main cannot collide with the runner's checked-out main branch.
• Add a real-git regression test covering issue Fork PR whose head branch matches the runner's checked-out branch fails: "refusing to fetch into branch 'refs/heads/main'" #1423.

Fixes #1423

Screenshots

No visual change.

Testing

• bun test test/setup-branch.test.ts
• bun run typecheck
• bun run format:check

Risk

• Low: same-repository PR checkout is unchanged; cross-repository PR checkout now uses the existing GitHub pull ref without updating local branches.

Notes

• This is distinct from fix: support fork PRs by fetching via refs/pull/N/head #1219/Fork PRs fail: action fetches branch by name instead of using refs/pull/N/head #1218: that change made fork PRs fetchable from refs/pull/N/head; this change avoids writing that fetched commit into a checked-out local branch.

AI Review Report

• Verified the current setupBranch fork path still fetched pull/N/head:<headRefName> before this patch.
• Added a regression test that starts on local main, exposes a fork PR ref also named main, and verifies HEAD detaches at the PR ref while refs/heads/main stays unchanged.

Security Audit

• Git commands still use execFileSync argv arrays, not shell interpolation.
• The new destination ref is derived from the numeric PR entity number, not from user-controlled branch text.