# DEVX-168: Fix create_dependency_pr master-ref parsing

## Problem

`devx.ci.create_dependency_pr` crashes with
`AttributeError: 'list' object has no attribute 'get'` when creating the
dependency branch. Gitea's `GET /repos/{o}/{r}/git/refs/heads/master`
returns a JSON **array** of matching refs, not a single object. Observed
in production when sso-bridge v0.4.1's post-merge dep-PR step ran.

## Approach

REQ-1: Normalize the ref response — if it is a list, select the entry
whose `ref` field equals `refs/heads/master` or fall back to the first
entry; proceed to extract `object.sha` as before. An empty or absent
SHA still fails closed.

## Test Plan

- Unit test: list-shaped response resolves SHA and creates the PR.
- Unit test: empty list fails with the master-SHA error message.

## Deploy Plan

devx releases as a version tag; sso-bridge/infra pin bumps pick it up via
their normal dep-PR flow.

## Rollback Plan

Revert the commit; dep-PR creation stays broken on Gitea (status quo).

## Acceptance Criteria

- [x] REQ-1: list-shaped ref response is handled; SHA extraction works;
  empty list still errors. Covered by unit tests at 100% coverage.