Fix checkout ref to use main branch in publish workflows

Ensure publish workflows check out the main branch to get the
latest bumped version after the bump-version workflow pushes changes.

Previously, workflows were checking out the SHA at trigger time,
which didn't include the version bump committed by bump-version job.

This fixes the "Verify version consistency" step failure where the
expected version didn't match the pyproject.toml version.

Related to: https://github.com/trycua/cua/actions/runs/19482814921

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

.github/workflows/pypi-publish-agent.yml

@@ -31,6 +31,8 @@ jobs:
       core_version: ${{ steps.update-deps.outputs.core_version }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: main
 
       - name: Determine version
         id: get-version

.github/workflows/pypi-reusable-publish.yml

@@ -47,6 +47,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: main
           fetch-depth: 0 # Full history for release creation
 
       - name: Set up Python