test(source): cover untagged source add following the default branch

[nmccready-tars]

What

Adds TestSourceAdd_Untagged_FollowsDefaultBranch — a sanity integration test for sync-agents source add with an untagged source (no @ref).

Why

An untagged entry (e.g. skill:foo/bar) is meant to track the repo's default branch. The implementation does this by resolving the empty ref to HEAD and hitting GET /repos/{owner}/{repo}/commits/HEAD (fetcher.go:160-166) — no hardcoded "main", no git ls-remote, so it follows main or master transparently (GitHub picks the default server-side).

But coverage had a gap: existing Add tests all used a tagged ref (@v1), and the empty-ref case was only exercised at the GitHubFetcher.ResolveRef unit level — never through the full source add pipeline (parse → manifest → resolve → fetch → extract → vendor → lock).

How

Drives the real Puller.Add path against a real GitHubFetcher pointed at an httptest fake GitHub (only GitHub is faked). Table-driven over two repos whose default-branch tip differs (main-tip vs master-tip). Each case asserts:

1. The manifest stores the untagged entry verbatim (no ref synthesized).
2. The skill is actually vendored (SKILL.md on disk).
3. The lock pins the default-branch tip SHA.
4. Resolution goes through commits/HEAD — the fake server 404s commits/main and commits/master, so the test fails if the client ever guesses a branch name instead of asking for HEAD.

Hermetic and offline (TokenFn stubbed so it never shells out to gh auth token). go vet clean; full internal/agent/source package green.

Scope note

This proves the client requests HEAD correctly. Whether real GitHub's commits/HEAD returns the default-branch tip is GitHub's contract, not something an httptest can assert — the test deliberately stops at the client boundary to stay offline. A bats-level version would need a SYNC_AGENTS_API_URL-style base-URL override on the CLI (currently the binary hardcodes &GitHubFetcher{}); happy to add that in a follow-up if we want end-to-end CLI coverage too.

🤖 Generated with Claude Code

[github-actions]

🤖 AI Code Review

✅ Clean review — no findings. (model: deepseek/deepseek-v4-flash)

_{model: deepseek/deepseek-v4-flash · est. cost: $0.0002}