fix: Guard netlify-fetch against a failing branch listing

Review feedback (set -e at the top / pipefail): make runs every recipe
line in its own shell, so a leading set -e would only govern itself,
and the shell is sh, which has no pipefail - but the spirit of the
comment found a real gap: a failing ls-remote inside the command
substitution would have silently emptied the loop. The list is now
captured and checked explicitly, and set -eu replaces set -e.

Author: lfrancke

Makefile

@@ -70,7 +70,10 @@ netlify-fetch:
 	# race the ref updates and silently leave a stale local branch behind,
 	# which only surfaces much later as a missing-object error from antora.
 	# Failures abort the build immediately instead.
-	set -e; for branch in $$(git ls-remote --heads origin | sed 's|.*refs/heads/||' | grep -E 'release[/-]'); do \
+	set -eu; \
+	branches="$$(git ls-remote --heads origin | sed 's|.*refs/heads/||' | grep -E 'release[/-]')"; \
+	[ -n "$$branches" ] || { echo "netlify-fetch: no release branches from ls-remote - refusing to continue"; exit 1; }; \
+	for branch in $$branches; do \
 		git -c gc.auto=0 fetch origin "+refs/heads/$$branch:refs/heads/$$branch"; \
 		git -c gc.auto=0 checkout -q "$$branch" -- . ; \
 	done