This is a follow-up to 1767107038 -
instead of checking out `FETCH_HEAD`, which always puts the user in
'detached HEAD' state, we will check out `${OMAKUB_REF:-stable}` so that
we only end up in 'detached HEAD' state when necessary (i.e. when
checking out a SHA rather than a branch).