feat: allow switching installed app branches

[aakvatech]

Summary

Add first-class support for changing the branch of an installed app from the Pilot Admin UI.

Pilot already had an internal SwitchBranchTask, but there was no Admin UI/API workflow to use it. This PR exposes that functionality and makes branch switching robust for shallow and single-branch clones.

Changes

• Add POST /apps/<name>/actions/switch-branch.

• Add Change branch to installed app actions.

• Load available remote branches using the existing Git branch endpoint.

• Queue the existing SwitchBranchTask for the actual switch.

• Add optional Force switch behavior to discard tracked and untracked local changes.

• Fetch the target branch using an explicit remote-tracking refspec:

  +refs/heads/<branch>:refs/remotes/origin/<branch>
  

• Keep .git/config synchronized after switching:

  • replace stale branch-specific remote.origin.fetch entries for single-branch clones;
  • preserve wildcard refs/heads/* fetch configuration for full clones;
  • set branch.<name>.remote = origin;
  • set branch.<name>.merge = refs/heads/<name>.

• Persist the selected branch back to bench.toml.

• Retain the existing validation, reinstall, asset build, and worker reload behavior.

• Document the new API.

Why

Apps may move away from deprecated branches, while existing Pilot installations remain configured and checked out on the old branch.

For single-branch clones, simply running:

git fetch origin <branch>

may only populate FETCH_HEAD and leave the clone's persistent fetch configuration still pointing at the deprecated branch.

This can leave three states inconsistent:

Git checkout branch
        ↕
.git/config tracking/refspec
        ↕
bench.toml configured branch

This PR keeps all three synchronized through a single managed Pilot operation.

Safety

Normal branch switching preserves local changes using the existing stash behavior.

Force switching is explicit and permanently discards tracked and untracked working-tree changes before switching.

Tests

Added coverage for:

• branch-switch API queueing;
• invalid branch validation;
• force propagation through SwitchBranchTask;
• switching from a single-branch clone to a previously untracked remote branch;
• .git/config refspec and upstream tracking updates;
• preservation of wildcard fetch refspecs on full clones;
• force switching with local tracked and untracked changes.

[aakvatech]

Fixes #542

[greptile-apps]

Confidence Score: 5/5

[High risk] Adds app branch switching to the admin API and task system.

No new blocking finding was identified; the PR appears safe to merge under the resolved review threads.

_{Reviews (7) · Last reviewed commit: "test: cover same-commit branch switch ro..."}