Address PR review feedback (#1747)

- core/store: include workspaceWorktrees in the slim and activity-log-limited
  SELECT lists (rowToTask reads it, but the explicit column lists omitted it, so
  slim/limited reads dropped the field and could misclassify workspace tasks);
  add regression tests for both read surfaces
- dashboard/register-git-github: validate caller-supplied repoPath in resolveGitDir
  via isPathWithin containment check (path-traversal hardening for all git
  endpoints); make loadWorkspaceConfig a static @fusion/core import per AGENTS.md
- dashboard/legacy: preserve repoPath in the string-form pullBranch overload
- dashboard/GitManagerModal: revalidate selectedRepo against the fetched repo list
  so a stale selection can't persist across project switches

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/dashboard/app/api/legacy.ts

@@ -3128,10 +3128,16 @@ export function pullBranch(
   projectId?: string,
   repoPath?: string,
 ): Promise<GitPullResult> {
-  const options = typeof optionsOrProjectId === "string" ? undefined : optionsOrProjectId;
-  const resolvedProjectId = typeof optionsOrProjectId === "string" ? optionsOrProjectId : projectId;
+  // FNXC:DashboardGitApi 2026-06-24-00:00:
+  // pullBranch has two overloads. In the string-arg style pullBranch(projectId, repoPath),
+  // the second positional carries repoPath (not the 3rd parameter), so resolve it from `projectId`
+  // to avoid dropping repoPath; otherwise multi-repo workspace pulls hit the wrong repo.
+  const isStringForm = typeof optionsOrProjectId === "string";
+  const options = isStringForm ? undefined : optionsOrProjectId;
+  const resolvedProjectId = isStringForm ? optionsOrProjectId : projectId;
+  const resolvedRepoPath = isStringForm ? projectId : repoPath;
 
-  return api<GitPullResult>(withRepoPath(withProjectId("/git/pull", resolvedProjectId), repoPath), {
+  return api<GitPullResult>(withRepoPath(withProjectId("/git/pull", resolvedProjectId), resolvedRepoPath), {
     method: "POST",
     body: JSON.stringify({ rebase: options?.rebase ?? false }),
   });