Prevent stale runner publication branches

[chubes4]

Summary

• resolve and report the exact base SHA before publishing runner workspace changes
• reuse a publication branch only when it has an exact open head/base PR and descends from the current base
• recover stale post-squash branches onto a deterministic base-SHA-suffixed branch, while safely reusing that recovered PR on later runs
• fail closed on unsafe branch collisions or divergent open PR branches

Closes #1894.

How to test

1. Run npm install.
2. Run npm run test:runner-workspace-publisher.
3. Confirm the stale post-squash fixture creates a fresh branch from the base tree and parent SHA.
4. Confirm a later publication reuses the exact open fresh-branch PR and appends to its current head.
5. Run npm run test:agent-task-workflow-interface.
6. Run npm run build.

Backwards compatibility

Existing exact open publication PRs continue to be extended. Existing branches without a matching safe PR are no longer reused as commit parents; this intentional behavior change prevents historical commits from leaking into later publications. The result adds branch.base_sha and commit.parent_sha without removing existing fields.

AI assistance

• AI assistance: Yes
• Tool(s): OpenAI GPT-5.6 Sol via OpenCode
• Used for: Reviewed and completed the implementation, added deterministic coverage, and prepared verification evidence.