Audit template repository health from the default branch

## Context

Follow-up from Kristen's approved review of #960: https://github.com/Azure/awesome-azd/pull/960#pullrequestreview-4930441850

The `workflow_dispatch` event allows a user to select any branch. The template repository health workflow currently checks out that selected branch, but creates, updates, or closes one repository-wide maintenance issue. A manual run from a feature branch could therefore make the official issue reflect unmerged catalog contents.

## Proposed change

- Pin the workflow checkout to `${{ github.event.repository.default_branch }}` for both scheduled and manually dispatched runs.
- Ensure the repository-wide maintenance issue always represents the catalog on the default branch.
- Add a workflow-level regression check if an existing test mechanism can cover checkout configuration.

## Acceptance criteria

- A manual run initiated while another branch is selected audits the default branch catalog.
- Scheduled behavior remains unchanged.
- The generated maintenance issue cannot be updated from unmerged catalog contents.

Follow-up to #960.

Start with the template repository health workflow and its workflow_dispatch and scheduled triggers; inspect how checkout currently selects the branch. Pin both paths to the repository default branch, then verify the manual-run and scheduled acceptance criteria, adding a workflow-level regression check only if an existing mechanism supports it.

Written by the indexing model from the issue text.