Publish the branch you are on, not always main

export-github.sh syncs the WORKING TREE, not a branch, and then committed
whatever it found onto the publication repo's main and printed
"git push origin main".

So running it while checked out on a site branch published that site's work AS
THE PRODUCT, to the repository every other site consumes, and said nothing. The
branch model made that reachable in one wrong command, from a checkout that
looks completely normal.

It now reads the current branch, mirrors it in the publication repo (creating it
from main the first time, as in the dev repo), bundles that branch, and prints
work-PC instructions naming it. Publishing anything other than main also prints
a reminder that other sites read main and these commits are not there yet.

The publication checkout uses --force, which is safe only because that tree is a
mirror: the rsync has already replaced it, so there is nothing local to lose. It
would not be safe anywhere else.

Also cleans up the publication repo: origin pointed at a bundle in a scratchpad
from a session that ended long ago, and two orphaned remote-tracking refs
(github/main, wilm/review-fixes) survived the removal of their remotes. None of
it broke the export, which never pushes, but a `git fetch` in there failed with
a confusing path.

Scope: product

tools/export-github.sh

@@ -29,6 +29,22 @@ done
 [ -n "$MSG" ] || { echo "usage: $0 [--dist] \"commit message\""; exit 1; }
 [ -d "$PUB/.git" ] || { echo "publication repo missing at $PUB"; exit 1; }
 
+# --- 0. which branch is being published -------------------------------------
+#
+# This syncs the WORKING TREE, not a branch, and it used to commit whatever it
+# found onto the publication repo's main and print "git push origin main". So
+# running it while checked out on a site branch published that site's work AS
+# THE PRODUCT, to the repository every other site consumes, without saying a
+# word about it.
+#
+# The publication repo now mirrors the branch you are actually on.
+BRANCH="$(git -C "$WORK" rev-parse --abbrev-ref HEAD)"
+if [ "$BRANCH" = "HEAD" ]; then
+  echo "detached HEAD in $WORK - check out a branch before exporting" >&2
+  exit 1
+fi
+echo "==> publishing branch: $BRANCH"
+
 # --- 1. sync the tree (working -> pub), minus everything never published ---
 #
 # NOTE the deploy/windows/installer/bundle exclude below. That is ~100MB of build
@@ -141,6 +157,19 @@ fi
 
 cd "$PUB"
 
+# Mirror the branch. The rsync above has already overwritten the tree, so this
+# has to happen with the working tree ignored - checkout would otherwise refuse
+# or clobber. --force is safe here precisely because the tree is a mirror: it
+# holds nothing that is not about to be replaced from $WORK.
+if git show-ref --verify --quiet "refs/heads/$BRANCH"; then
+  git checkout --force "$BRANCH" >/dev/null
+else
+  # A new site branch starts from main, the same way it does in the dev repo,
+  # so its history is the product's history plus whatever it adds.
+  echo "==> publication repo: creating branch $BRANCH from main"
+  git checkout --force -b "$BRANCH" main >/dev/null
+fi
+
 # --- 2. re-apply the publication wording (idempotent) ---
 # docs/ lives only in the wiki on the GitHub side.
 # NOTE the `|| true` on each scrub grep below. grep exits 1 when it matches
@@ -205,7 +234,8 @@ fi
 git log --oneline -3
 
 # --- 5. bundle for transfer (full bundle: stateless, fetch takes only new) ---
-git bundle create "$OUT/shopdb-flask-pub.bundle" HEAD main --tags
+# Carries the branch that was published, not a hardcoded main.
+git bundle create "$OUT/shopdb-flask-pub.bundle" HEAD "$BRANCH" --tags
 git bundle verify "$OUT/shopdb-flask-pub.bundle" >/dev/null
 echo "bundle: $OUT/shopdb-flask-pub.bundle"
 
@@ -222,10 +252,22 @@ if [ "$BUILD_DIST" = 1 ]; then
   done
 fi
 
-cat <<'EOF'
+cat <<EOF
 
 On the work PC (in the shopdb-flask-pub clone):
-  git fetch <path-to>\shopdb-flask-pub.bundle main
+  git checkout $BRANCH
+  git fetch <path-to>\shopdb-flask-pub.bundle $BRANCH
   git merge --ff-only FETCH_HEAD
-  git push origin main
+  git push origin $BRANCH
 EOF
+
+if [ "$BRANCH" != "main" ]; then
+  cat <<EOF
+
+NOTE: this published $BRANCH, not main. Other sites read main, so nothing here
+reaches them until these commits are promoted:
+
+  tools/wj-status.sh
+  tools/promote-to-main.sh <sha> ...
+EOF
+fi