fix(client): resolve default branch from the remote advertisement

A cached bare clone's HEAD points at refs/heads/<branch>, which is written
once at clone time and never updated again — fetch only touches
refs/remotes/*. Syncs without --ref therefore resolved the frozen
clone-time revision forever: the literal "cached version of the repo"
symptom.

Resolve the default branch via remote.List instead: the advertised HEAD
(plain hash or symref target) is the only source of truth. Verified
against the production Forgejo instance; e2e test fails on the pre-fix
binary and passes now.

internal/client/pull.go

@@ -31,7 +31,15 @@ func Pull(cacheDir, url, ref, token, tokenUser string) (*PullResult, error) {
 	if err != nil {
 		return nil, err
 	}
-	hash, err := resolveRemoteRef(repo, ref)
+	var hash plumbing.Hash
+	if ref == "" {
+		// The cached bare clone's HEAD is frozen at clone time (fetch never
+		// updates refs/heads/*), so the default branch must be asked from the
+		// remote directly — never resolved through local refs.
+		hash, err = resolveDefaultBranch(repo, auth)
+	} else {
+		hash, err = resolveRemoteRef(repo, ref)
+	}
 	if err != nil {
 		return nil, fmt.Errorf("resolving %q in %s: %w", refLabel(ref), gitsource.RedactURL(url), err)
 	}
@@ -86,6 +94,43 @@ func openOrCreate(cacheDir, url, ref string, auth gittransport.AuthMethod) (*git
 	return repo, nil
 }
 
+// resolveDefaultBranch asks the remote for its advertised HEAD — the only
+// source of truth for the default branch tip. HEAD may be advertised as a
+// plain hash or as a symbolic reference to one of the advertised refs; both
+// are handled. Local refs are never consulted: the cached bare clone's HEAD
+// is frozen at clone time because fetch updates only refs/remotes/*.
+func resolveDefaultBranch(repo *git.Repository, auth gittransport.AuthMethod) (plumbing.Hash, error) {
+	remote, err := repo.Remote(git.DefaultRemoteName)
+	if err != nil {
+		return plumbing.ZeroHash, fmt.Errorf("reading remote: %w", err)
+	}
+	refs, err := remote.List(&git.ListOptions{Auth: auth})
+	if err != nil {
+		return plumbing.ZeroHash, fmt.Errorf("listing remote refs: %w", err)
+	}
+	hashes := map[string]plumbing.Hash{}
+	var head *plumbing.Reference
+	for _, ref := range refs {
+		if ref.Name() == plumbing.HEAD {
+			head = ref
+			continue
+		}
+		if ref.Type() == plumbing.HashReference {
+			hashes[ref.Name().String()] = ref.Hash()
+		}
+	}
+	if head == nil {
+		return plumbing.ZeroHash, errors.New("remote advertises no HEAD")
+	}
+	if head.Type() == plumbing.HashReference {
+		return head.Hash(), nil
+	}
+	if h, ok := hashes[head.Target().String()]; ok {
+		return h, nil
+	}
+	return plumbing.ZeroHash, fmt.Errorf("advertised HEAD points at %s, which was not advertised", head.Target())
+}
+
 // repointRemote aligns the cached origin with the configured URL so a fleet
 // re-point takes effect on the next sync.
 func repointRemote(repo *git.Repository, url string) error {