Safe primary refresh fails when authoritative checkout is detached

[chubes4]

Summary

An authoritative primary can be registered in detached-HEAD state. workspace show reports Branch: HEAD and Freshness: detached, but the documented safe refresh command delegates to plain git pull and fails because no branch is checked out.

Related prior issue: #833 fixed/reported the missing-upstream case for a checked-out branch. Detached HEAD is a separate unrecoverable state through the current safe-refresh contract.

Evidence

Observed locally for wp-codebox:

$ studio wp datamachine-code workspace show wp-codebox
Name:     wp-codebox
Path:     /Users/chubes/Developer/wp-codebox
Branch:   HEAD
Remote:   https://github.com/Automattic/wp-codebox.git
Latest:   e7c862c3 ...
Freshness: detached
Upstream: -

The documented recovery fails:

$ studio wp datamachine-code workspace git pull wp-codebox --allow-primary-refresh
Error: Git command failed (exit 1): You are not currently on a branch.
Please specify which branch you want to merge with.

    git pull <remote> <branch>

The primary was stale relative to origin/main, so this blocked the owning safe-refresh path before creating isolated work.

Expected

workspace git pull <repo> --allow-primary-refresh should recover a detached authoritative primary deterministically:

1. Resolve the repository default branch from the registered remote.
2. Verify the detached commit can be safely moved to that branch under primary-refresh policy.
3. Check out/create the local default branch tracking origin/<default>.
4. Fast-forward only.
5. Return explicit evidence of the repaired branch/upstream and refreshed head.

workspace hygiene should also classify detached primaries as repairable or blocked with an actionable reason, rather than leaving the documented refresh command dead.