fix(ci): create dep-PR branches via POST /branches

Gitea lacks the POST /git/refs endpoint (HTTP 405). Use the branches
API with new_branch_name/old_branch_name; tolerate already-exists.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/specs/DEVX-169.md

@@ -0,0 +1,33 @@
+# DEVX-169: create_dependency_pr uses branches API
+
+## Problem
+
+After DEVX-168, dep-PR creation fails at `POST /git/refs` with
+`HTTP 405 Method Not Allowed` — this Gitea version does not implement the
+createRef endpoint. Observed creating the sso_bridge 0.4.1 infra
+dependency PR.
+
+## Approach
+
+REQ-1: Create the dependency branch via `POST /branches` with
+`new_branch_name`/`old_branch_name` (from master). An already-exists
+error is tolerated; other API errors fail closed.
+
+## Test Plan
+
+- Branch creation calls `POST /branches` with the expected payload.
+- 422 already-exists is tolerated and the PR is still created.
+- Other API errors abort with a branch-creation failure.
+
+## Deploy Plan
+
+devx release tag; producers pick it up via pin bumps.
+
+## Rollback Plan
+
+Revert; dep-PR creation stays broken (status quo).
+
+## Acceptance Criteria
+
+- [x] REQ-1: branch creation uses the branches API; already-exists
+  tolerated; failures surface. Covered by unit tests at 100% coverage.