fix(tag-repos): take branch from TAG_REPOS entry, not expected_branch

cmd_tag_repos unpacked dev_b/main_b from the TAG_REPOS entry but then
re-derived the branch via expected_branch(), which consults the real
stack_repos() table. After the pi de-fork, 'pi' is no longer in that
table, so test_devstack_tag_repos (which tags a fake 'pi' repo) resolved
an empty branch, 'rev-parse origin/' exited 128 while still printing the
argument to stdout, the empty-sha guard was bypassed, and the command
attempted a garbage 'origin/:refs/tags/...' push — CI test job failed.

- select the branch from the TAG_REPOS tuple (mirrors the CI tag-repos
  job and keeps the command testable with a mocked repo set)
- harden the guard: check the rev-parse exit code, not just empty output

Author: localpibox

scripts/lpb-devstack

@@ -67,7 +67,6 @@ from localpibox.stack.version import (  # noqa: E402
     _find_version_file,
     bump_version,
     detect_pipeline,
-    expected_branch,
     get_version,
 )
 from localpibox.stack.workspace import (  # noqa: E402
@@ -207,7 +206,10 @@ def cmd_tag_repos(cons: Console, *, pipeline: str = "dev",
 
     failures = 0
     for name, dev_b, main_b in TAG_REPOS:
-        b = expected_branch(name, pipeline)
+        # Branch comes from the TAG_REPOS entry (mirrors the CI tag-repos
+        # job); do not re-derive via expected_branch() — it would ignore
+        # the actual tagging set and fail for repos no longer in the stack.
+        b = dev_b if pipeline == "dev" else main_b
         path = _resolve_repo_path(name)
         if path is None:
             cons.error(f"  {name}: no local clone at {_tag_repo_hint(name)} — "
@@ -218,8 +220,9 @@ def cmd_tag_repos(cons: Console, *, pipeline: str = "dev",
         if code != 0:
             cons.error(f"  {name}: fetch failed ({(err.strip() or out.strip())[:80]})")
             return 1
-        sha = git(path, "rev-parse", f"origin/{b}")[0].strip()
-        if not sha:
+        sha_out, _, sha_code = git(path, "rev-parse", f"origin/{b}")
+        sha = sha_out.strip()
+        if sha_code != 0 or not sha:
             cons.error(f"  {name}: branch '{b}' not found on origin — aborting (fail fast)")
             return 1