pub fn encode_branch_component(branch: &str) -> String
Encode a branch name as base64url (without padding) for ref-safe storage.