fix: verify final gate against remote main

scripts/release-local-gate.test.mjs

@@ -2,6 +2,7 @@ import { describe, expect, it } from 'vitest';
 import {
     linuxGateCommand,
     parseGateArgs,
+    parseRemoteMain,
     playwrightImageFromLock
 } from './release-local-gate.mjs';
 
@@ -20,6 +21,13 @@ describe('local release gate contract', () => {
         expect(() => playwrightImageFromLock({ packages: {} })).toThrow('must pin');
     });
 
+    it('extracts main only from the exact remote branch record', () => {
+        const sha = '0123456789abcdef0123456789abcdef01234567';
+        expect(parseRemoteMain(`${sha}\trefs/heads/main\n`)).toBe(sha);
+        expect(() => parseRemoteMain('')).toThrow('could not resolve origin main');
+        expect(() => parseRemoteMain(`${sha}\trefs/heads/not-main`)).toThrow('could not resolve origin main');
+    });
+
     it('runs the complete CI-equivalent dependency, verify, and browser sequence', () => {
         expect(linuxGateCommand()).toBe([
             'git clone --no-local /src /work',