Runner workspace publisher ignores configured branch

## Problem

The reusable workflow request can provide both `runner_workspace.branch` and `runner_workspace.branch_prefix`, but `runner-workspace-publisher.mjs` ignores `branch` and always computes the publication head as `${branch_prefix}${run_id}`. When the caller supplies the same stable value for both fields, the workload id is concatenated without a separator.

Hosted evidence: https://github.com/Automattic/agents-api/actions/runs/29473678677
Published PR: https://github.com/Automattic/agents-api/pull/430

The request specified:

```json
{
"branch": "docs-agent/agents-api-docs-upkeep",
"branch_prefix": "docs-agent/agents-api-docs-upkeep"
}
```

The successful publication result instead reported:

```json
{
"head": "docs-agent/agents-api-docs-upkeepdocs-agent-technical-maintenance"
}
```

## Expected

A configured exact `runner_workspace.branch` is the publication head. `branch_prefix + run_id` remains the fallback when no exact branch is configured. Validation must keep both paths bounded and safe, and deterministic coverage should prove existing exact branches are reused across runs.

## Impact

Publication succeeds, but caller-declared stable branch identity is not honored and generated branch names can be malformed or unexpected.

Start with runner-workspace-publisher.mjs and trace how runner_workspace.branch and branch_prefix are read when publishing a workspace. Compare the exact-branch and fallback paths, then inspect the existing deterministic coverage or add coverage where appropriate. Done means configured exact branches are reused safely across runs and fallback branch names remain bounded and safe.

Written by the indexing model from the issue text.