fix: allow @ in branch names (used by Gastown and other multi-agent tools)

[jerhinesmith]

Problem

validateBranchName uses a strict character whitelist that excludes @, causing the action to fail on PRs from branches like polecat/nux/bo-gpl@moxcd5jj with:

Invalid branch name: "polecat/nux/bo-gpl@moxcd5jj". Branch names must start with an alphanumeric character and contain only alphanumeric characters, forward slashes, hyphens, underscores, periods, hashes (#), or plus signs (+).

Context

Multi-agent orchestration tools like Gastown generate branch names of the form polecat/<name>/<project>@<sessionid>, where @ separates a task name from a unique session ID. Engineers using these tools open PRs from these branches and see the review job fail immediately.

Fix

Add @ to the whitelist pattern. The @{ sequence (git reflog syntax) is still explicitly rejected by its own dedicated check later in the function — this PR doesn't touch that. Bare @ carries no injection risk since all git calls use execFileSync (not shell interpolation), which is the same rationale used when + was added in #1248 and # was added in #1167.

Before:

const validPattern = /^[a-zA-Z0-9][a-zA-Z0-9/_.#+-]*$/;

After:

const validPattern = /^[a-zA-Z0-9][a-zA-Z0-9/_.#+@-]*$/;

Changes

• src/github/operations/branch.ts — add @ to whitelist; update comment and error message
• test/validate-branch-name.test.ts — add test cases for @-containing branch names