pushSignedCommits fallback pushes stale branch ref after rebasing detached HEAD

### Summary

When `pushSignedCommits` rebases a stale bundle onto the current remote PR head, then `createCommitOnBranch` fails transiently, the git fallback pushes the stale named branch instead of the rebased `HEAD`. The fallback is therefore rejected as non-fast-forward.

### Reproduction

- gh-aw commit under test: `278730aed86e`
- samples mode: enabled
- parent run: https://github.com/githubnext/gh-aw-test/actions/runs/33941175759
- failing child: https://github.com/githubnext/gh-aw-test/actions/runs/33943239896
- workflow: `test-copilot-siderepo-push-to-pull-request-branch-using-dispatch`

Relevant sequence:

```text
Remote PR head: 7e5803af957db135c077af9a97e16376c732ff44
Bundle commit parent: f577dfeb101e9b7ec274e4b292c73d6d6ac57ae0
git rebase --onto 7e5803af... f577dfeb... HEAD
Successfully rebased and updated detached HEAD.
Rebased commit: 5dbbb415004736fa7ab2a597ba594ddb0500b59e
POST /graphql -> HTTP 502
pushSignedCommits: GraphQL signed push failed, falling back to git push
git push origin test-pr-1788580618-30202-26693
! [rejected] ... (non-fast-forward)
```

The remote remained at `7e5803af...`; this was not a partial GraphQL mutation. The named local branch still pointed at the pre-rebase bundle tip, while the recovered commit existed only at detached `HEAD`.

### Root cause

After the stale-parent recovery rebases detached `HEAD`, `pushBranchAndResolveHead()` uses:

```js
["push", "origin", branch]
```

That pushes the stale local branch ref rather than the rebased commit. The same behavior is still present at current local gh-aw HEAD `8e30bcd889` in `actions/setup/js/push_signed_commits.cjs`.

### Expected behavior

The fallback should push the rebased commit explicitly, for example `HEAD:refs/heads/` (with the existing fast-forward/lease protections), or update the named local branch to rebased `HEAD` before invoking the fallback. Transient GraphQL 5xx should also receive bounded retries before fallback.

### Deduplication

Searched for `pushSignedCommits` + `non-fast-forward`, `GraphQL signed push failed`, `rebase --onto` + `git push`, and signed-push HTTP 502. #39804 discusses transient 5xx handling for PR-review safe outputs but does not cover this stale named-ref fallback defect.