fix(ci): clone gitops repo with an explicit branch, not via HEAD resolution

Third failure: ashwin/nxtgauge-gitops's server-side HEAD symref is broken
("remote HEAD refers to nonexistent ref" on plain clone, even though
refs/heads/main exists via the API) - a Forgejo-level repo quirk, not
something to fix here. backend-rust's workflow survives this by accident
(it does an explicit git checkout after cloning); clone with -b main
directly instead of relying on HEAD resolution at all.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.forgejo/workflows/build.yaml

@@ -82,7 +82,11 @@ jobs:
           git config --global credential.helper '!f() { printf "%s\\n" "username=forgejo-actions"; printf "%s\\n" "password=$GITOPS_TOKEN"; }; f'
 
           GITOPS_DIR=$(mktemp -d)
-          git clone "$GITOPS_REPO" "$GITOPS_DIR"
+          # -b main: this repo's server-side HEAD symref is broken (returns
+          # "remote HEAD refers to nonexistent ref" on a plain clone even
+          # though refs/heads/main exists) - an explicit branch bypasses
+          # HEAD resolution entirely instead of relying on it.
+          git clone -b main "$GITOPS_REPO" "$GITOPS_DIR"
           cd "$GITOPS_DIR"
 
           # release-patch.yaml carries a Flux $imagepolicy marker comment on