oven: let `git checkout <ref>` resolve via local objects (fix short SHA)
The knot git server (tangled) rejects direct-SHA fetch-over-wire for
abbreviated 9-char commit hashes — `git fetch origin 35b90245e` errors
with "couldn't find remote ref". Preflight-sync was calling that fetch
unconditionally for every caller-specified ref, then the followup
`git checkout <ref>` would fail with "pathspec did not match" because
the local object db still had the old tip.
Fix: drop the direct-SHA fetch. `git fetch origin main` (always run
above it) brings in every commit reachable from main's tip, including
the requested ref. Local `git checkout <ref>` then resolves the
abbreviation against the just-updated object db and works for both
full and short SHAs.
No functional change when a caller passes a ref that's already on
main; restores the short-SHA convenience API that worked before the
knot switchover.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>