fix: collapse worktrees to main repo, ignore $HOME-as-git-root

[NovakPAai]

Summary

Sessions whose cwd lives inside a linked git worktree, or sessions launched from \$HOME when home itself happens to be a git repo, were being mismapped to the wrong project / wrong GitHub remote in the dashboard.

This PR fixes resolveGitRoot() in src/data.js so the project identity (and downstream remote inference) is stable for those cases.

Changes

• Linked worktrees collapse to the main repo. git worktree list --porcelain is parsed for its first record (the main worktree) before falling back to rev-parse --show-toplevel. Previously every linked worktree appeared as its own "project".
• Bare repos are skipped. Paths ending in .git (what --porcelain reports for bare repos) are dropped — downstream code assumes a working tree.
• Symlinked paths are normalized via fs.realpathSync so macOS /var vs /private/var doesn't duplicate the same physical project.
• \$HOME-as-git-root is rejected. When the home directory itself is a git repo (e.g. a dotfiles repo), sessions launched from home no longer inherit that remote.
• Disk cache filename bumped to -v2.json to invalidate stale entries from before the fix.

Tests

test/git-root-resolve.test.js — 7 cases:

• 3 unit tests for _parseMainWorktree (happy path, empty input, lines that look like records but aren't).
• 4 integration tests using real git in os.tmpdir(): linked worktree → main, bare repo → empty, symlink → normalized to real path, \$HOME-as-git-root → empty (skipped if home isn't a repo on the machine).

All 7 pass locally. Pre-existing test/wsl-windows.test.js failure on macOS is unrelated to this change.

Deferred (out of scope)

• Atomic disk-cache writes (writeFileSync → tmp + rename). Project-wide pattern in the existing cache helpers; addressing it here would balloon the diff.
• Debug-log on the silent porcelain → rev-parse fallback. Zero-dependency project has no logger; left as a comment-level TODO.

Test plan

• Run node --test test/git-root-resolve.test.js — all 7 pass.
• In the dashboard, sessions whose cwd was a linked worktree now group under the main repo's project card.
• Sessions whose cwd is \$HOME (when home is a git repo) no longer carry that repo's remote.

[NovakPAai]

Merge sequence

Merge this PR first. It has no conflicts with main and is needed as the foundation for #213.

After this merges:

• feat: background git fetch for connected repos (auto-refresh v1) #213 will be rebased onto the new main (currently CONFLICTING in src/frontend/app.js, src/frontend/styles.css, src/server.js due to feat: Projects tab → Projects (launcher) + History subtabs + agent picker #211's Projects-tab refactor).
• The exported resolveGitRoot from this PR is then injected into the RepoRefreshManager in feat: background git fetch for connected repos (auto-refresh v1) #213, completing the known-roots gate that defends initOnStartup against settings-file injection.

#213 is not safe to merge before this one — without the bare-repo skip + $HOME rejection + symlink normalization from this PR, the getKnownGitRoots() set used by /api/repo-refresh/trigger and initOnStartup would contain spurious entries.