Cloud tasks: derive default git ref from environment/repo

Context

• codex cloud exec / cloud task creation requires a git_ref so the backend knows what to check out.
• Today, when --branch is not provided, the CLI resolves git_ref from local git state (current branch -> repo default branch from git metadata -> hard-coded fallback "main").

Problem

• If the CLI can't resolve local git metadata (detached HEAD, missing remote HEAD, not in a checkout, etc.), it falls back to "main".
• This breaks for repos whose default branch is "master" (see #9111). PR #9149 is a minimal-risk fix (retry master when fallback main is rejected), but the underlying UX remains: in “no local git metadata” scenarios, the CLI is guessing.

Proposal
Make the backend authoritative for the default branch (it already knows which repo a cloud environment is tied to):

Option A (preferred): allow omitting git_ref (or sending null/empty) when --branch isn't provided; backend defaults to the repo's configured default branch.

Option B: add an API endpoint / environment metadata field that returns the repo's default branch, so the CLI can pick it without guessing.

Why not call the GitHub API from the CLI?

• It would require additional GitHub auth/permissions and doesn't generalize to non-GitHub providers.
• In cases where the CLI isn't run inside a repo checkout, it may not even know the owner/repo to query.

Acceptance criteria

• Creating a cloud task without --branch succeeds for repos with default branches named master, main, or anything else, even when local git metadata is unavailable.
• --branch continues to override.

Related

• Bug report: #9111
• Minimal-risk fix: #9149