Craft cloudflare target: ${VAR} expansion guard misses API-inferred productionBranch

Fixed (PR #843 follow-up): craft's config-time ${VAR} expansion guard for productionBranch originally only checked the literal string in user config — the API-inferred production branch (fetched at runtime from Cloudflare's Pages API and pushed into --branch) bypassed it entirely. Fix applied: extracted the regex into a reusable ENV_EXPANSION_REGEX constant and applied it inside resolveProductionBranch() to the resolved branch too, treating a match as unresolved (returns undefined, falls back to omitting --branch). Both the config-supplied and API-inferred paths are now checked symmetrically.