fix: reject reserved Git HEAD branch

backend/src/config.ts

@@ -45,6 +45,7 @@ function refSafeGitBranch(value: string): string {
   const branch = requiredRegistryValue(value, "branch");
   if (
     branch === "@"
+    || branch === "HEAD"
     || branch.startsWith("-")
     || branch.startsWith("/")
     || branch.endsWith("/")

backend/test/workspaces-config.test.ts

@@ -53,6 +53,11 @@ test("rejects ref-unsafe Git branches", () => {
   }
 });
 
+test("rejects the reserved HEAD branch without rejecting lowercase head", () => {
+  expect(() => loadConfig({ THT_WORKSPACE_GIT_BRANCH: "HEAD" })).toThrow(/branch/i);
+  expect(loadConfig({ THT_WORKSPACE_GIT_BRANCH: "head" }).workspaceRegistry.branch).toBe("head");
+});
+
 test("rejects control characters in installation IDs", () => {
   for (const codePoint of [...Array(0x20).keys(), ...Array(0x21).keys()].map((code, index) => (
     index < 0x20 ? code : code + 0x7f