fix(evo-deploy): prefer the fetched remote branch when resolving the deploy ref

A manual deploy.sh run without a SHA resolved the local 'main' first,
which lags behind origin/main in the deploy checkout, and redeployed the
old commit. Resolve <remote>/<ref> first and fall back to the ref itself
for SHAs and tags.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YMUEBB4pr4TtGSMhEAKonM

ops/evo-deploy/deploy.sh

@@ -286,10 +286,13 @@ git_fetch_and_checkout() {
   log "previous HEAD: $previous_sha"
   log "fetching $EVO_GIT_REMOTE…"
   run git -C "$EVO_DEPLOY_DIR" fetch "$EVO_GIT_REMOTE" --prune >&2
-  if git -C "$EVO_DEPLOY_DIR" rev-parse --verify "${EVO_DEPLOY_REF}^{commit}" >/dev/null 2>&1; then
-    target_sha="$(git -C "$EVO_DEPLOY_DIR" rev-parse "${EVO_DEPLOY_REF}^{commit}")"
-  elif git -C "$EVO_DEPLOY_DIR" rev-parse --verify "${EVO_GIT_REMOTE}/${EVO_DEPLOY_REF}^{commit}" >/dev/null 2>&1; then
+  # Prefer the freshly fetched remote branch: the local `main` in the deploy
+  # checkout never moves (we reset HEAD, not the branch), so resolving it first
+  # would redeploy a stale commit.
+  if git -C "$EVO_DEPLOY_DIR" rev-parse --verify "${EVO_GIT_REMOTE}/${EVO_DEPLOY_REF}^{commit}" >/dev/null 2>&1; then
     target_sha="$(git -C "$EVO_DEPLOY_DIR" rev-parse "${EVO_GIT_REMOTE}/${EVO_DEPLOY_REF}^{commit}")"
+  elif git -C "$EVO_DEPLOY_DIR" rev-parse --verify "${EVO_DEPLOY_REF}^{commit}" >/dev/null 2>&1; then
+    target_sha="$(git -C "$EVO_DEPLOY_DIR" rev-parse "${EVO_DEPLOY_REF}^{commit}")"
   else
     die "cannot resolve ref: $EVO_DEPLOY_REF"
   fi