Sync from dev @ 14435d1

Source: main (14435d1)
Excluded: live tenant exports, generated artifacts, and dev-only tooling.

scripts/ensure_rolling_pr.py

@@ -512,7 +512,14 @@ def main() -> int:
         print("##vso[task.setvariable variable=DRIFT_PR_SUPPRESSED;isOutput=true]0")
         return 0
 
-    _run_git(args.repo_root, ["fetch", "--quiet", "origin", baseline_branch, drift_branch])
+    _run_git(args.repo_root, ["fetch", "--quiet", "origin", baseline_branch])
+    try:
+        _run_git(args.repo_root, ["fetch", "--quiet", "origin", drift_branch])
+    except RuntimeError as exc:
+        if "couldn't find remote ref" in str(exc).lower() or "could not find remote ref" in str(exc).lower():
+            pass  # Drift branch may not exist yet; fallback to HEAD below.
+        else:
+            raise
     baseline_commitish = f"origin/{baseline_branch}" if _ref_has_commit(args.repo_root, f"origin/{baseline_branch}") else baseline_branch
     drift_commitish = f"origin/{drift_branch}" if _ref_has_commit(args.repo_root, f"origin/{drift_branch}") else "HEAD"
     if not _workload_config_diff_exists(