use_commit_signing path skips generated branch-name validation and fails later in github_file_ops #1573

Describe the bug

When branch_name_template produces an invalid git ref name, the non-signing
path rejects it early with validateBranchName(newBranch), but the
use_commit_signing: true path does not perform the same validation.

Instead, the invalid branch name is handed to github-file-ops-server, and the
first commit attempt fails later with a GitHub API error such as:

Failed to create branch: 422 - {"message":"Reference update failed","errors":[{"message":"Reference name is not valid"}]}

This makes the behavior inconsistent across commit modes and delays a
configuration error until the first remote file-ops call.

To Reproduce

1. Configure a workflow that creates a new Claude branch, with:

use_commit_signing: true
branch_name_template: "{{prefix}}release:{{entityNumber}}"

2. Trigger a flow that creates a fresh Claude branch (for example an issue
   flow, or a closed/merged PR flow).
3. Let Claude make a change that reaches the first
   mcp__github_file_ops__commit_files call.
4. Observe that branch creation fails with a late GitHub API error because the
   generated branch name contains :.

For comparison:

• with use_commit_signing: false, the generated newBranch is validated
  locally before checkout/creation;
• with use_commit_signing: true, the same newBranch is not pre-validated
  before being passed to the file-ops server.

Expected behavior

Both commit modes should validate the generated branch name consistently
before handing it off to downstream git or GitHub API operations.

If the template yields an invalid branch name, the run should fail early with a
clear validation error rather than waiting for the first file-ops branch-create
attempt.

Screenshots

Not included.

Workflow yml file

Minimal relevant fragment:

on:
  issues:
    types: [opened]

jobs:
  claude:
    runs-on: ubuntu-latest
    steps:
      - uses: anthropics/claude-code-action@main
        with:
          use_commit_signing: true
          branch_name_template: "{{prefix}}release:{{entityNumber}}"
          prompt: "Make a small change"

API Provider

[x] Anthropic First-Party API (default)
[ ] AWS Bedrock
[ ] GCP Vertex

Additional context

• branch_name_template is a documented action input.
• A template like {{prefix}}release:{{entityNumber}} currently generates
  claude/release:123.
• In src/github/operations/branch.ts, the non-signing path validates
  newBranch, but the use_commit_signing path validates only sourceBranch
  before returning the unvalidated claudeBranch.
• A local reproduction of the real src/mcp/github-file-ops-server.ts against
  a mock GitHub API produced the following branch-create body:

{"ref":"refs/heads/claude/release:123","sha":"base-sha-1"}

• A likely fix is to run validateBranchName(newBranch) before the
  use_commit_signing early return, so both commit modes enforce the same
  branch-name rules.