Fix #NI: Keep release-plz on attached branch

[Sild]

Summary

• check out the repository default branch by name so release-plz has an attached branch and upstream
• retain the existing equality guard that requires the checked-out SHA to match the commit that passed Build-Test
• leave version bumps and generated changelog entries owned by release-plz

Validation

• Rust pre-push gate: clippy, nightly rustfmt, full tests, doctests, and live service integration tests
• actionlint 1.7.12
• Ruby YAML parsing
• cargo metadata --no-deps --format-version 1
• git diff --check