strategy: rename EnsureMetadataBranch to EnsurePrimaryRef

The function now operates on refs.Primary, not the v1 branch literal. Local ref, remote-tracking name, and user-facing output use Primary's short name. The origin-bootstrap path is gated on PrimaryFetchableFromOrigin so refs that aren't pushed skip it and create an empty orphan directly.