[Copilot AI] Branch refs from MR metadata not re-validated before git commands

[nexiouscaliver]

Problem

At omniforge_mcp_server.py:250-255, source/target branch names from MR metadata are used directly in git commands without calling validate_branch_name().

Assessment

Downgraded from Copilot's Medium to P3-low because:

• Branch names come from GitLab API (trusted source)
• run_exec uses list args (no shell injection risk)
• Risk is limited to confusing git errors on malformed refs

Fix Direction

Call validate_branch_name() on both branches before use.

Acceptance Criteria

• Validate source/target branches from metadata
• Return structured error on invalid refs

Identified by Copilot AI agent. Re-rated: Medium -> P3-low (trusted source, no injection risk).