fix(infra): resolve commit-sha=HEAD to remote branch tip, not local PVC HEAD

When commit-sha defaults to "HEAD", git checkout HEAD is a no-op — it keeps
the PVC's stale checkout. Now resolves HEAD to origin/{branch} after fetch,
ensuring the latest pushed code is always compiled.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/argo/compile-and-train-template.yaml

@@ -170,6 +170,7 @@ spec:
           - |
             set -e
             SHA="{{workflow.parameters.commit-sha}}"
+            BRANCH="{{workflow.parameters.git-branch}}"
 
             # SSH setup
             mkdir -p ~/.ssh
@@ -188,12 +189,16 @@ spec:
             # so cargo skips recompiling unchanged workspace crates.
             if [ -d "$BUILD/.git" ]; then
               cd "$BUILD"
+              git fetch origin
+              # Resolve SHA: "HEAD" means remote branch tip, not local HEAD
+              if [ "$SHA" = "HEAD" ]; then
+                SHA=$(git rev-parse "origin/$BRANCH")
+              fi
               CURRENT=$(git rev-parse HEAD 2>/dev/null || echo "none")
               if [ "$CURRENT" = "$SHA" ]; then
                 echo "=== Already at $SHA, skipping checkout ==="
               else
                 echo "=== Updating checkout: $(echo $CURRENT | cut -c1-8) -> $(echo $SHA | cut -c1-8) ==="
-                git fetch origin
                 git checkout --force "$SHA"
                 git clean -fd
               fi
@@ -201,7 +206,11 @@ spec:
               echo "=== Initial clone (first run) ==="
               git clone --filter=blob:none "$REPO" "$BUILD"
               cd "$BUILD"
-              git checkout "$SHA"
+              if [ "$SHA" = "HEAD" ]; then
+                git checkout "origin/$BRANCH"
+              else
+                git checkout "$SHA"
+              fi
             fi
             SHORT_SHA=$(git rev-parse --short HEAD)
             echo "Checked out ${SHORT_SHA}"