fix: preserve reviewed client hardening branches

[ORESoftware]

Outcome

Prevents the nightly Clients SDK fleet controller from discarding reviewed remediation on an existing automation/nightly-client-hardening branch.

The 2026-08-19 fleet run reset existing branches to the default branch before generation and then used --force-with-lease. That replaced corrected AthletO and Fiducia branch histories with regenerated scaffolding and moved previously green PRs back to red exact heads.

Changes

• fetch and check out an existing automation branch instead of recreating it from the default branch;
• fail closed when the reviewed branch does not contain the current default-branch tip;
• never push generated changes when schema, package, consumer, or canary validation failed;
• add regression assertions for branch preservation and validation-gated publishing;
• add a narrow credential-free PR workflow that executes the controller tests and syntax checks whenever the nightly controller changes.

Exact-head evidence

Head 34380fdf3b3b5a8e67b6081f8713e017044f1d94:

• nightly clients controller contract — run 32333780986 — PASS
• baseline policy — run 32333780989 — PASS
• public-privacy-boundary — run 32333780959 — PASS
• controller shell syntax, Python compilation, executable branch-preservation tests, validation-gated push tests, and git diff --check all passed in the contract lane.

A local Git fixture also confirmed that this clone configuration refreshes origin/$BRANCH when executing git fetch origin "$BRANCH"; no unnecessary explicit-ref rewrite was added.

Scope and remaining blockers

This prevents destructive recurrence. It does not claim a successful fleet-wide run or certify registry authority, immutable provenance, schema parity, all external consumers, paired test-org canaries, or currently missing toolchains. Those remain tracked under DEN-3475 and DEN-3714.

Rollback

Revert the merge commit. The controller will return to recreating the automation branch from the default branch and may overwrite reviewed remediation on the next successful publish, so rollback should be used only with the nightly schedule disabled.

Linear: DEN-3475, DEN-3714

[linear-code]

DEN-3714