fix(room-source): avoid stale default-branch imports

[kchen0x]

Fixes #11

Summary

• resolve branch refs to their current commit SHA before requesting package files
• keep the original branch name for source metadata and UI, while using the immutable SHA for jsDelivr tree and file URLs
• retain tag behavior and CDN-based distribution without issuing one GitHub API request per package file
• add a regression test that rejects any @main jsDelivr request after resolving a branch

Validation

• vitest run packages/room-source/src/githubSource.test.ts
• tsc -b
• vitest run (110 files, 661 tests)
• vite build in apps/web

The bug was browser-reproduced with kchen0x/parti-decrypto: root URL import returned stale 1.0.0; tree/v1.0.2 imported the current filesystem package.