stop naming a branch when pulling the capabilities repository

The plugin and capabilities repositories were standardised on `master`, and
five places said `origin main` — the setup script's sync and the Update-all
path. Swapping them to `master` would be the same mistake wearing a new name.

`HEAD` resolves to whatever the remote's default is, so the question stops
being asked, exactly as it now does for the marketplace icon URLs. Only the
LOCAL branch still needs a name.

Third time today that naming a branch was the bug: the icon URLs 404'd on four
repositories created as `master`, and these would have broken the moment the
rest were renamed to match.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/setup/officer-setup/lib/layout.sh

@@ -85,7 +85,9 @@ capabilities_sync() {
   local dir; dir="$(layout_items_dir)"
 
   if [[ -d "$dir/.git" ]]; then
-    (cd "$dir" && git pull --ff-only --quiet origin main 2>/dev/null) || return 1
+    # `HEAD` rather than a branch name — it resolves to the remote's default, so standardising the
+    # repositories on one name does not break this the way naming `main` did.
+    (cd "$dir" && git pull --ff-only --quiet origin HEAD 2>/dev/null) || return 1
     return 0
   fi
 
@@ -99,7 +101,7 @@ capabilities_sync() {
     (cd "$dir" \
       && git init --quiet \
       && git remote add origin "$CAPABILITIES_REPO" 2>/dev/null \
-      && git fetch --quiet origin main \
-      && git checkout --quiet -B main FETCH_HEAD) || return 1
+      && git fetch --quiet origin HEAD \
+      && git checkout --quiet -B master FETCH_HEAD) || return 1
   fi
 }