Runner workspace publisher ignores configured branch

## Problem

The reusable workflow request can provide both `runner_workspace.branch` and `runner_workspace.branch_prefix`, but `runner-workspace-publisher.mjs` ignores `branch` and always computes the publication head as `${branch_prefix}${run_id}`. When the caller supplies the same stable value for both fields, the workload id is concatenated without a separator.

Hosted evidence: https://github.com/Automattic/agents-api/actions/runs/29473678677
Published PR: https://github.com/Automattic/agents-api/pull/430

The request specified:

```json
{
"branch": "docs-agent/agents-api-docs-upkeep",
"branch_prefix": "docs-agent/agents-api-docs-upkeep"
}
```

The successful publication result instead reported:

```json
{
"head": "docs-agent/agents-api-docs-upkeepdocs-agent-technical-maintenance"
}
```

## Expected

A configured exact `runner_workspace.branch` is the publication head. `branch_prefix + run_id` remains the fallback when no exact branch is configured. Validation must keep both paths bounded and safe, and deterministic coverage should prove existing exact branches are reused across runs.

## Impact

Publication succeeds, but caller-declared stable branch identity is not honored and generated branch names can be malformed or unexpected.

Commencez par runner-workspace-publisher.mjs et suivez la façon dont runner_workspace.branch et branch_prefix sont lus lors de la publication d’un workspace. Comparez les chemins exact-branch et de fallback, puis examinez la couverture déterministe existante ou ajoutez-en là où c’est approprié. Le travail est terminé lorsque les branches exact configurées sont réutilisées en toute sécurité d’une exécution à l’autre et que les noms de branche de fallback restent bornés et sûrs.

Rédigé par le modèle d'indexation à partir du texte de l'issue.