A hosted git specifier that resolved over HTTPS without the repository
being provably public lost its committish from the specifier written
back to the manifest: `pnpm add owner/repo#develop` recorded
`git+https://github.com/owner/repo.git`.
The URL that branch records doubles as the `git ls-remote` target, which
must carry no committish, so it was built with `noCommittish`. The
committish still reached resolveRef, so the install pinned the right
commit and nothing looked wrong — until the next re-resolve read a
specifier that no longer named a branch and moved the dependency to the
default branch.
Keep the `ls-remote` target committish-free and build the recorded
specifier from the same host template with the committish left in, which
is what every other branch of fromHostedGit already produced through
shortcut().
pacquet reaches its equivalent branch only for a URL carrying its own
credentials, and drops the committish there the same way; it is fixed
alongside.
Fixespnpm/pnpm#13999
---------
Co-authored-by: Zoltan Kochan <z@kochan.io>
