getRevisionBranchName detached SHA fallback

Trap: git name-rev --name-only --no-undefined <sha> looks required before checkout because named release branches are preferred, but a CI-approved detached SHA has no name and must remain publishable. Fix: getRevisionBranchName() catches the lookup failure and returns ''; publishMain() checks out branchName || rev. This preserves named-ref behavior while allowing exact immutable CI revisions.