[Feat] Self-heal stored repository default branches from the worker

[daniel-lxs]

What changed

• New repositories.reportDefaultBranch SDK mutation that updates a stored repository row's default_branch, targeted by repository row id and only when the value actually differs.
• Run tokens are authorized against their own workspace before the write is allowed: the selected repository, a member of the selected repository set, any active repository for all-repositories tasks, or a repository mapped into the run's environment. Terminal runs refuse the token; auth tokens keep the existing deployment-scoped access.
• When an implicit-branch task resolves origin/HEAD to a branch that differs from the stored default, the worker reports the resolved branch back through the SDK. Fire-and-forget: it never blocks or fails repository preparation, and explicit branch selections never report.
• The worker now runs git remote set-head origin --auto before trusting the clone-time origin/HEAD symbolic ref, so reused workspaces follow remote default-branch changes; on failure (offline, rate-limited) it falls back to the cached ref, which is still verified against remote-tracking refs.

Why

Stored repository metadata can go stale (or be born wrong via the schema-level default('main')) and nothing refreshes it outside a manual installation resync. The worker already computes the authoritative default branch from origin/HEAD during checkout resolution and then discards that knowledge. Reporting it back lets wrong rows self-heal organically for every provider, including self-hosted deployments where webhook delivery may be broken.

Follow-up to #635; addresses the stale-origin/HEAD finding from its review as well.

Validation

• pnpm exec dotenvx run -f .env.test -- pnpm --filter @roomote/worker exec vitest run src/workspace/__tests__ src/commands/setup/__tests__/workspace.test.ts (70 tests)
• pnpm exec dotenvx run -f .env.test -- pnpm --filter @roomote/sdk exec vitest run src/server/lib/repositories/__tests__/update-default-branch.test.ts (8 real-database tests: auth-token update, run-token workspace scoping across repo/set/all/environment shapes, cross-repo and terminal-run rejection, no-op match, unknown/inactive rows)
• pnpm --filter @roomote/worker check-types, pnpm --filter @roomote/sdk check-types, pnpm lint

🤖 Generated with Claude Code

[roomote-roomote]

No new code issues found. See task

• packages/sdk/src/server/routers/repositories.ts:39-54 Resolved: reporting now targets a repository row ID and validates the run workspace before allowing the write.
• packages/sdk/src/server/lib/repositories/update-default-branch.ts:62-64 Resolved: a host-stamped run now requires an equal repository row host, refusing legacy null-host rows rather than crossing self-managed instances.
• packages/sdk/src/server/lib/repositories/update-default-branch.ts:42-65 Resolved: all_repositories now requires the payload provider, so a run token cannot report a row for another provider that the worker never prepared.
• apps/worker/src/workspace/workspace-manager.ts:936-953 Resolved: on set-head failure, the worker checks ls-remote --symref origin HEAD before falling back to the verified cached ref.
• packages/sdk/src/server/lib/repositories/update-default-branch.ts:124-133 Resolved: updating by repository ID prevents reports from overwriting same-name rows on other self-managed hosts.

_{Reviewed 0558f32}