merge main: resolve db.test.ts import conflict

Combined both branches: TaskStore import from main + rmSync import
from our branch (needed for fresh DB test cleanup).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.changeset/merger-allowlist-staging.md

@@ -0,0 +1,9 @@
+---
+"@fusion/engine": patch
+---
+
+Restrict merger staging to squash + fix-agent files; refuse to commit unrelated working-tree changes
+
+Replaces the blanket `git add -A` in `commitOrAmendMergeWithFixes` with an explicit allowlist: only files that were squash-staged or explicitly modified by the in-merge verification fix agent are staged. Any other dirty files in the working tree are left untouched and a warning is logged naming each excluded path. Fixes a production bug where ~13 unrelated user-edited files were bundled into a task's squash commit.
+
+Hardened by code review: replaced all shell-interpolated `git add` calls in `commitOrAmendMergeWithFixes` and the conflict-resolution helpers (`resolveWithOurs`, `resolveWithTheirs`, `resolveTrivialWhitespace`) with `execFile` array form to eliminate path-injection surface; adopted `git -z` NUL-delimited output for all dirty-file path queries in both `snapshotDirtyFiles` and `commitOrAmendMergeWithFixes` so paths with embedded spaces round-trip correctly; truncated long allowlist debug log lines to at most 20 entries.

.changeset/settings-modal-mobile-full-height.md

@@ -0,0 +1,5 @@
+---
+"@runfusion/fusion": patch
+---
+
+Make the settings modal fill the viewport on mobile and align section headings with form-group gutters for consistent spacing across each settings page.

.changeset/test-cache-content-hash.md

@@ -0,0 +1,7 @@
+---
+"@runfusion/fusion": patch
+---
+
+Cache per-package test results by content hash to skip unchanged packages across sequential merges.
+
+`scripts/test-changed.mjs` now maintains a per-project cache at `.fusion/test-cache.json`. For each package in a changed-mode run, a SHA-256 is computed from the git blob SHAs of every tracked file in the package directory plus `pnpm-lock.yaml` and `tsconfig.base.json`. If the hash matches a cache entry younger than 7 days the package is excluded from the `pnpm --filter` invocation and tests are skipped. After a successful run the passing hashes are written atomically. Cache lookups are bypassed when `FUSION_TEST_NO_CACHE=1` or `--no-cache` is passed, and never applied to full-suite runs. A new `FUSION_TEST_WORKSPACE_CONCURRENCY` env var controls `--workspace-concurrency` (default `2`).

.changeset/verification-cache-and-concurrency.md

@@ -0,0 +1,5 @@
+---
+"@runfusion/fusion": minor
+---
+
+Cache merge verification by tree hash and boost test concurrency for in-review verification.