fix(canon): mirror-sync detects upstream default branch (master vs main)

Adversary-flagged: drone/gitea mirror-sync hit rc=128 ('couldn't find remote ref main') —
coopcloud/coop-cloud/{drone,gitea} use `master`, not `main`. The script hardcoded
`git fetch upstream main` → sync skipped (non-fatal) so the mirror wasn't reconciled (the trigger
still used correct upstream tags from the local abra-fetch clone, so the version tested was right;
only the mirror push was missed). Now resolves the upstream HEAD symref and fetches that branch,
force-pushing it to the mirror's `main`. Consumes BUILDER-INBOX.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/recipe-mirror-sync.sh

@@ -54,9 +54,14 @@ else
   git remote add upstream "${UPSTREAM_URL}"
 fi
 
-echo "→ Fetching upstream main + tags (${UPSTREAM_URL})..."
-git fetch --quiet --tags upstream main
-NEW_MAIN_SHA="$(git rev-parse refs/remotes/upstream/main)"
+# Detect the upstream DEFAULT branch — coop-cloud recipes are not uniformly `main` (e.g. drone, gitea
+# use `master`). Hardcoding `main` made `git fetch upstream main` FATA (rc=128) for those, skipping
+# their sync. Resolve the remote HEAD symref; fall back to `main`.
+UPSTREAM_BRANCH="$(git ls-remote --symref upstream HEAD 2>/dev/null | awk '/^ref:/{sub(/refs\/heads\//,"",$2); print $2; exit}')"
+UPSTREAM_BRANCH="${UPSTREAM_BRANCH:-main}"
+echo "→ Fetching upstream ${UPSTREAM_BRANCH} + tags (${UPSTREAM_URL})..."
+git fetch --quiet --tags upstream "${UPSTREAM_BRANCH}"
+NEW_MAIN_SHA="$(git rev-parse FETCH_HEAD)"
 MAIN_TREE="$(git rev-parse "${NEW_MAIN_SHA}^{tree}")"
 
 # Ensure the mirror repo exists (reconcile-only: if absent, nothing to do).