fix: fail closed on unknown audit default branch

[brickfrog]

Summary

• Route the actual merge_pr gate through Result-based default-branch detection so git failure blocks before merge-host execution.
• Treat empty/whitespace symbolic-ref output as unknown, preserving the legacy fallback helper for non-gating callers.
• Add direct merge-path and empty-output regression coverage.

Verification

• moon test --target native — 2,280 passed
• moon run src/bin/choir_lint --target native — passed

Verification

Generated by Choir from commands executed in the leaf workspace.

• moon test --target native
  • exit: 0
  • head: 70d660b
  • output tail:

----- BEG5
IN MOON TEST RESULT -----
{"type":"start","file":"exec_test.mbt","index":9}
----- END MOON TEST RESULT -----
Total tests: 2280, passed: 2280, failed: 0.

• moon run src/bin/choir_lint --target native
  • exit: 0
  • head: 70d660b

[brickfrog]

Choir: GitHub Actions rollup reports all checks successful on the latest head — re-check review/merge policy on GitHub (not an approval or merge signal by itself).

[brickfrog]

Choir: GitHub Actions rollup reports all checks successful on the latest head — re-check review/merge policy on GitHub (not an approval or merge signal by itself).

[brickfrog]

Choir: GitHub Actions rollup reports all checks successful on the latest head — re-check review/merge policy on GitHub (not an approval or merge signal by itself).