fix(FN-5456): tidy autocorrect shell quoting and disambiguate checkout

- Hoist `refs/heads/<name>` into a single quoted token before the verify
  call so the shell-quote boundary is unambiguous in the rendered
  command.
- Append `--` to the recovery `git checkout` so a same-named tracked
  path cannot win the DWIM resolution. The ref existence was already
  verified, so this can only resolve as the branch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/engine/src/__tests__/branch-autocorrect.test.ts

@@ -87,8 +87,8 @@ describe("attemptBranchAutocorrect", () => {
     expect(result).toEqual({ status: "checked-out" });
     expect(mockedExec.mock.calls.map((c: unknown[]) => c[0])).toEqual([
       "git rev-parse --abbrev-ref --symbolic-full-name 'lemon-sage'@{u}",
-      "git show-ref --verify --quiet refs/heads/'fusion/fn-2'",
-      "git checkout 'fusion/fn-2'",
+      "git show-ref --verify --quiet 'refs/heads/fusion/fn-2'",
+      "git checkout 'fusion/fn-2' --",
     ]);
   });
 

packages/engine/src/branch-autocorrect.ts

@@ -96,14 +96,17 @@ export async function attemptBranchAutocorrect({
   // contamination pattern). Restrict the verify to refs/heads/ so a stray tag
   // or remote ref with the same name cannot satisfy the check and lead the
   // subsequent `git checkout` to a detached HEAD on the wrong object.
+  const expectedRefArg = quoteShellArg(`refs/heads/${expected}`);
   const verifyExpected = await runGit(
-    `git show-ref --verify --quiet refs/heads/${expectedArg}`,
+    `git show-ref --verify --quiet ${expectedRefArg}`,
     worktreePath,
   );
   if (!verifyExpected.ok) {
     return { status: "failed", reason: `expected branch ${expected} does not exist` };
   }
-  const checkout = await runGit(`git checkout ${expectedArg}`, worktreePath);
+  // `--` disambiguates against a same-named tracked path; we already proved
+  // the ref exists, so this can only resolve as the branch.
+  const checkout = await runGit(`git checkout ${expectedArg} --`, worktreePath);
   if (checkout.ok) {
     return { status: "checked-out" };
   }