feat(FN-3875): add GitHub tracking auth resolver and forced client auth mod

Implements a tracking auth resolver with forced GitHub client authentication mode, wiring it across the GitHub tracking lifecycle and settings UI. The feature spans six steps: adding the resolver, forced auth mode, routing tracking issue creation through the resolver, and wiring into lifecycle and s

Fusion-Task-Id: FN-3875

packages/core/src/github-tracking.ts

@@ -1,5 +1,7 @@
 import type { GlobalSettings, ProjectSettings, Task } from "./types.js";
 
+export const REPO_OVERRIDE_RE = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+
 export interface RepoSlug {
   owner: string;
   repo: string;
@@ -32,7 +34,7 @@ export function parseRepoSlug(input: string | undefined | null): RepoSlug | null
 }
 
 export function isValidRepoSlug(input: string): boolean {
-  return parseRepoSlug(input) !== null;
+  return REPO_OVERRIDE_RE.test(input.trim());
 }
 
 export function resolveTaskGithubTracking(

packages/core/src/types.ts

@@ -1374,6 +1374,8 @@ export interface TaskCreateInput {
   nodeId?: string;
   /** Optional explicit user assignment for this task (used during review handoff) */
   assigneeUserId?: string;
+  /** Per-task GitHub issue tracking overrides for Fusion-created linked issues. */
+  githubTracking?: Pick<TaskGithubTracking, "enabled" | "repoOverride">;
   /** Review level for task execution — controls review rigor: 0=None, 1=Plan Only, 2=Plan and Code, 3=Full */
   reviewLevel?: number;
   /** Execution mode for task implementation.