Keeping one shared codebase and moving everything brand-specific into a resource package that plugs into that shared core is what avoids the fork. A change to business logic, security behavior, or compliance rules then gets made once and applies to every tenant immediately.