Runner workspace publisher ignores configured branch

## Problem

The reusable workflow request can provide both `runner_workspace.branch` and `runner_workspace.branch_prefix`, but `runner-workspace-publisher.mjs` ignores `branch` and always computes the publication head as `${branch_prefix}${run_id}`. When the caller supplies the same stable value for both fields, the workload id is concatenated without a separator.

Hosted evidence: https://github.com/Automattic/agents-api/actions/runs/29473678677
Published PR: https://github.com/Automattic/agents-api/pull/430

The request specified:

```json
{
"branch": "docs-agent/agents-api-docs-upkeep",
"branch_prefix": "docs-agent/agents-api-docs-upkeep"
}
```

The successful publication result instead reported:

```json
{
"head": "docs-agent/agents-api-docs-upkeepdocs-agent-technical-maintenance"
}
```

## Expected

A configured exact `runner_workspace.branch` is the publication head. `branch_prefix + run_id` remains the fallback when no exact branch is configured. Validation must keep both paths bounded and safe, and deterministic coverage should prove existing exact branches are reused across runs.

## Impact

Publication succeeds, but caller-declared stable branch identity is not honored and generated branch names can be malformed or unexpected.

Inizia da runner-workspace-publisher.mjs e segui come vengono letti runner_workspace.branch e branch_prefix durante la pubblicazione di un workspace. Confronta i percorsi exact-branch e di fallback, quindi esamina la copertura deterministica esistente o aggiungi copertura dove appropriato. Il lavoro è completato quando i branch exact configurati vengono riutilizzati in modo sicuro tra un’esecuzione e l’altra e i nomi dei branch di fallback rimangono delimitati e sicuri.

Scritto dal modello di indicizzazione a partire dal testo della issue.