[BryanFRD]

Closes #1333

On a stable release the push target came from workspace.branch regardless of the checked-out branch (only prereleases used the current branch). Running ferrflow release from a maintenance branch such as 1.1.x therefore pushed and verified against main, which failed with E2009.

ReleaseInputs::target_branch is now always the checked-out branch. resolve_current_branch already falls back to workspace.branch on a detached HEAD without CI branch variables, so that case is unchanged. The stale-attempt warning now names the branch actually released from.

Tests cover a stable release on 1.1.x with workspace.branch = main and the unchanged main case.

[ferrfleet-interne]

This looks correct. cleanup_failed_release_attempt already reset against resolve_current_branch (release.rs:170). Push, verify, PR base and the stale warning now use that same branch, so the retry loop no longer pushes to one branch and resets another. The tests cover the 1.1.x and main cases.

Nit: this changes behaviour for stable runs on a branch that is neither workspace.branch nor in branches. Release commits and PRs used to target main; now they target the checked-out branch, and nothing guards against running on a feature branch. That is probably what you want, but a line in the changelog or docs would help.

Nit: release.rs:100-102 opens the repo again just to name the branch in the warning. Returning the resolved branch from cleanup_failed_release_attempt, or resolving it once before the loop, would avoid the duplicate lookup.

[ferrfleet-interne]

6c1afba fixes the duplicate-lookup nit: the branch is now resolved once before the retry loop and passed to warn_stale_attempt. Nothing new broke.

Nit: cleanup_failed_release_attempt (release.rs:166) still calls resolve_current_branch itself. Passing it &branch would remove the last duplicate lookup and guarantee the reset uses the same branch the warning names.