fix: allow # in branch names for PR checkout and base restore

[qozle]

Problem

validateBranchName rejects #, causing the action to fail on PRs from branches like put-back-arm64-#2:

##[error] Invalid branch name: "put-back-arm64-#2". Branch names must start with an
alphanumeric character and contain only alphanumeric characters, forward slashes,
hyphens, underscores, or periods.

There is no workaround — the branch already exists in git, and GitHub provided its name through the event payload. Fixes #1137.

Root cause

The whitelist regex /^[a-zA-Z0-9][a-zA-Z0-9/_.-]*$/ excludes #. The validation exists to prevent command injection, but every git call in the action uses execFileSync, which bypasses the shell entirely (arguments go directly to the kernel via execve). There is no shell to interpret #, so the strict whitelist was blocking valid names with no security benefit.

# is explicitly permitted by git-check-ref-format.

Fix

Add # to the whitelist: /^[a-zA-Z0-9][a-zA-Z0-9/_.#-]*$/. Update the JSDoc and error message to match.

Testing

• 3 new test cases covering # in mid-name and path-segment positions
• All existing rejection cases still pass
• bun test: 654 pass, 0 fail