fix: allow leading underscore in branch names (valid per git-check-ref-format)

[riley-mete-db]

Problem

validateBranchName() rejects branch names that start with an underscore, even though they are valid per git check-ref-format:

Error: Action failed with error: Invalid branch name: "_release/v0.4.15". Branch names must start with an alphanumeric character or '@' and contain only alphanumeric characters, forward slashes, hyphens, underscores, periods, hashes (#), plus signs (+), commas (,), or at signs (@).

Underscores are already allowed everywhere in the name except the first character. Because setupBranch() validates the PR's baseRefName after checking out an open PR (src/github/operations/branch.ts), the action fails on every open PR targeting a branch like _release/v1.2.3 — a common convention for release/internal branches. There is no input that bypasses this path.

Fix

Add _ to the first-character class of the whitelist pattern:

-  const validPattern = /^[a-zA-Z0-9@][a-zA-Z0-9/_.#+,@-]*$/;
+  const validPattern = /^[a-zA-Z0-9@_][a-zA-Z0-9/_.#+,@-]*$/;

A leading underscore carries no option-injection risk — only a leading dash does, and that is still rejected separately. All git calls already go through execFileSync, so there is no shell-interpolation risk either. The error message and doc comments are updated to match.

This follows the same pattern as prior fixes relaxing this whitelist for other git-valid characters: # (#1137), @ (#998), + (#1248), , (#1310).

Testing

• Added cases to test/validate-branch-name.test.ts covering _release/v1.2.3, _internal, and _wip/feature-x
• bun test: 770 pass, 0 fail
• bun run typecheck: clean
• prettier --check on changed files: clean

🤖 Generated with Claude Code