fix: git cache refresh fetches but does not update HEAD when ref is unset

[ulises-jeremias]

Problem

download_repository(..., refresh=\"always\") runs git fetch but, when the source has no explicit ?ref=, never merges/resets to the remote default branch tip. Cached template banks stay on an old commit forever (until deleted).

Impact

After renames in cpa-templates (e.g. extensions/github-setup → extensions/all-github-setup), users with a warm cache hit ManifestLoadError: template directory not found: .../all-github-setup even with --refresh always / --no-cache path that still reuses the git cache entry.

Expected

Match CNA git.ts behavior: on refresh, checkout + pull/reset to the tracked remote tip so HEAD advances.

Acceptance

• Refresh with no ref advances HEAD to origin/HEAD (or origin/main)
• Missing configured subdir forces a refresh even if meta says cache is fresh
• Regression test with a local remote + two commits