Fix task checkout branches for agent completion pushes

[simple-agent-manager]

Summary

• checkout generated task output branches for new task/subtask work when no explicit branch is supplied
• preserve explicit branch behavior for continuing existing branches
• add source-contract tests covering TaskRunner branch/outputBranch wiring

Validation

• pnpm --filter @simple-agent-manager/api test -- task-runner-do-service.test.ts
• pnpm --filter @simple-agent-manager/api typecheck

Preflight

• Preflight completed before code changes

Classification

• external-api-change
• cross-component-change
• business-logic-change
• public-surface-change
• docs-sync-change
• security-sensitive-change
• ui-change
• infra-change

External References

N/A: No external API or third-party behavior changed; this is internal SAM task dispatch and TaskRunner branch wiring.

Codebase Impact Analysis

Touched task dispatch wiring in apps/api/src/routes/tasks/submit.ts, apps/api/src/routes/tasks/run.ts, apps/api/src/routes/mcp/dispatch-tool.ts, apps/api/src/routes/mcp/orchestration-tools.ts, apps/api/src/durable-objects/sam-session/tools/dispatch-task.ts, and apps/api/src/durable-objects/sam-session/tools/retry-subtask.ts. The change keeps explicit branch behavior intact and only changes default checkout behavior to use generated task output branches.

Documentation & Specs

N/A: No public behavior, docs site content, setup flow, or user-facing copy changed. Added source-contract regression coverage in apps/api/tests/unit/task-runner-do-service.test.ts.

Constitution & Risk Check

Checked Principle XI / no hardcoded values and fail-closed security posture. The change removes default-branch checkout coupling for generated task branches without adding hardcoded environment values. Main risk is branch selection regression, covered by focused source-contract tests and API typecheck.

Notes

This is a focused fallback remediation for the confirmed default-branch auto-push risk discovered during the CTO review orchestration. It intentionally avoids changing VM-agent git push semantics and instead ensures TaskRunner workspaces start on the branch they are expected to push.

[codspeed-hq]

Merging this PR will not alter performance

✅ 6 untouched benchmarks

---

_{Comparing sam/daily-code-review-3ne67k (8cf4919) with main (44adc7e)}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud