Ensure workflows fetch absolute latest main after version bump

Add explicit git fetch and reset after checkout to guarantee
workflows get the most recent main branch commits, including
version bumps pushed by the bump-version workflow.

The issue: When using workflow_call, even with ref: main, GitHub
Actions may use a cached repository state from workflow run start.
This caused version consistency checks to fail because the checkout
didn't include the just-pushed version bump.

Solution: After checkout, explicitly fetch and reset to origin/main
to ensure we have the absolute latest code. Added logging to show
the current commit for debugging.

Fixes: https://github.com/trycua/cua/actions/runs/19482970320

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

.github/workflows/pypi-publish-agent.yml

@@ -33,6 +33,14 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: main
+          fetch-depth: 0
+
+      - name: Ensure latest main branch
+        run: |
+          git fetch origin main
+          git reset --hard origin/main
+          echo "Current HEAD commit:"
+          git log -1 --oneline
 
       - name: Determine version
         id: get-version

.github/workflows/pypi-reusable-publish.yml

@@ -50,6 +50,13 @@ jobs:
           ref: main
           fetch-depth: 0 # Full history for release creation
 
+      - name: Ensure latest main branch
+        run: |
+          git fetch origin main
+          git reset --hard origin/main
+          echo "Current HEAD commit:"
+          git log -1 --oneline
+
       - name: Set up Python
         uses: actions/setup-python@v4
         with: