fix(client): resolve default branch from the remote advertisement

A cached bare clone's HEAD points at refs/heads/<branch>, which is written
once at clone time and never updated again — fetch only touches
refs/remotes/*. Syncs without --ref therefore resolved the frozen
clone-time revision forever: the literal "cached version of the repo"
symptom.

Resolve the default branch via remote.List instead: the advertised HEAD
(plain hash or symref target) is the only source of truth. Verified
against the production Forgejo instance; e2e test fails on the pre-fix
binary and passes now.

README.md

@@ -197,7 +197,10 @@ repository, the local manifest and the on-disk content:
 - upstream deleted & modified → **skip + warn** — your version stays
 
 Sync is idempotent (a second run is a byte-level no-op) and fails cleanly:
-an unreachable repository never leaves a half-deployed machine.
+an unreachable repository never leaves a half-deployed machine. The default
+branch is resolved from the remote's advertised `HEAD`, so a sync without
+`--ref` always tracks the server's current default branch — even after the
+cache has been re-fetched many times.
 
 ### Configuration