Resolve omitted publication base from repository default branch

[chubes4]

Problem

The generic runner-workspace publisher currently resolves the publication base with:

config.base || config.base_branch || "main"

main is not a universal repository default. Callers that omit an explicit publication base can successfully materialize and verify a workspace, then fail at publication when the target uses trunk or another default branch.

Observed evidence: https://github.com/Automattic/build-with-wordpress/actions/runs/29645661510

The run reached publication and failed with GitHub API GET /git/ref/heads/main failed with 404.

Desired contract

1. Explicit runner_workspace.base remains authoritative.
2. The existing base_branch alias remains supported.
3. When neither is supplied, query the target repository metadata and use its default_branch.
4. Fail clearly if repository metadata does not provide a valid default branch.
5. Add deterministic tests for explicit non-main base, metadata-derived non-main default, and invalid/missing default metadata.

Docs Agent caller mapping is tracked separately in Automattic/docs-agent#156.