safe-outputs: extract-base-branch regex too permissive (accepts foo..bar, main.lock; rejects release/v1.2+hotfix)

## Summary

The auto-injected `Extract base branch from agent output` step (id `extract-base-branch`) in safe-outputs `create-pull-request` / `push-to-pull-request-branch` lock.yml uses a regex that doesn't match `git check-ref-format` semantics:

```bash
if [[ "$BASE_BRANCH" =~ ^[a-zA-Z0-9/_.-]+$ ]] && [ ${#BASE_BRANCH} -le 255 ]; then
```

This regex:

- **Accepts invalid refs** that git rejects, e.g.:
- `foo..bar` (consecutive dots — git refuses)
- `main.lock` (refs cannot end in `.lock`)
- `.foo`, `foo.`, `foo/.bar` (leading/trailing dots, slash-dot)
- **Rejects valid refs** that git accepts, e.g.:
- `release/v1.2+hotfix` (the `+` character is allowed by git)
- branch names containing `~` or other safe-but-non-ASCII characters that git allows

## Reproducer

```shell
#!/bin/bash
set -euo pipefail

regex='^[A-Za-z0-9/_.-]+$'
for ref in 'feature/x' 'release/v1.2+hotfix' 'foo..bar' 'main.lock'; do
[[ "$ref" =~ $regex ]] && regex_ok=yes || regex_ok=no
if git check-ref-format --branch "$ref" >/dev/null 2>&1; then
git_ok=yes
else
git_ok=no
fi
printf '%-24s regex=%-3s git=%s\n' "$ref" "$regex_ok" "$git_ok"
done
```

Expected output shows divergence between the regex and what git considers valid.

## Suggestion

Use `git check-ref-format --branch "$BASE_BRANCH"` directly rather than a hand-rolled regex. It's the canonical authority on what's a valid branch name and matches what subsequent `git checkout` / `actions/checkout` will actually accept.

## Where this lives

The step is auto-injected by gh-aw at compile time; it appears in compiled `*.lock.yml` files like `worker-fix.lock.yml` (line ~1457 in v0.72.0 output). Consumers can't hand-edit lock files, so this needs to be fixed at the gh-aw codegen layer.

## Context

Reported by CodeRabbit on a downstream consumer's PR (gominimal/min-aw#101). Filing here since the affected code is gh-aw-generated.