fix(lvl5): lint executor PR-path — abra lint selects+checks out the repo DEFAULT BRANCH; scratch clone of a detached per-run tree has none (FATA, live 400-402), and a stale default would be silently linted instead of the PR head. Force local main AT the tested ref + repoint origin to the scratch itself (offline tag fetch, no drift). Regression test with detached two-commit source proves exact-ref content is linted. 247 unit tests green; real-abra detached-source smoke pass.

runner/harness/lint.py

@@ -128,14 +128,35 @@ def run_lint(recipe: str, ref: str | None, out_dir: str | None) -> dict:
             text=True,
             timeout=LINT_TIMEOUT,
         )
-        if ref:
-            subprocess.run(
-                ["git", "-C", clone, "checkout", "-f", "--quiet", ref],
-                check=True,
-                capture_output=True,
-                text=True,
-                timeout=LINT_TIMEOUT,
-            )
+        # abra lint SELECTS AND CHECKS OUT THE REPO'S DEFAULT BRANCH before linting (observed
+        # live, build 400-402: a clone of a detached-HEAD per-run tree has no local branch →
+        # FATA "failed to select default branch"; and if a default branch existed at some OTHER
+        # commit, abra would silently lint THAT, not the tested ref). So: force a local `main`
+        # AT exactly the tested ref and make it the default everywhere abra could look —
+        # HEAD, and origin (repointed to the scratch itself, which also turns abra's tag
+        # force-fetch into an offline no-op; the run's true tags were already cloned in).
+        subprocess.run(
+            ["git", "-C", clone, "checkout", "-f", "--quiet", "-B", "main"]
+            + ([ref] if ref else []),
+            check=True,
+            capture_output=True,
+            text=True,
+            timeout=LINT_TIMEOUT,
+        )
+        subprocess.run(
+            ["git", "-C", clone, "remote", "set-url", "origin", clone],
+            check=True,
+            capture_output=True,
+            text=True,
+            timeout=LINT_TIMEOUT,
+        )
+        subprocess.run(
+            ["git", "-C", clone, "remote", "set-head", "origin", "main"],
+            check=False,  # cosmetic: helps any origin-HEAD-based default-branch lookup
+            capture_output=True,
+            text=True,
+            timeout=LINT_TIMEOUT,
+        )
         # catalogue: R006 (published catalogue version) reads it; servers: harmless, some abra
         # paths stat it. Symlink the live ones (read-only use).
         for shared in ("catalogue", "servers"):