A repo cloned on a box no longer shows as a second project card

[pallaoro]

TaskWindow existed locally; a new project called TaskWindow was then created from the iOS app on hetzner-devbox and the repo cloned into it. The desktop board came back showing them as two separate projects.

Cause

The board merges a repo's copies across engines into one card by (githubOwner, githubName) (unify.ts), and that identity was written once at registration and never again (dispatcher.ts, the only two writers). The phone's New project calls register(path, { init: true }), which creates the folder, git inits it and registers it before anything is cloned in, so detectGithubRepo had no origin to read and the row was born with no identity.

The timestamps on the box confirm it: the project row was created at 21:22:25Z, and ~/TaskWindow/.git/config was written at 21:42:03Z, 20 minutes later.

This is not cosmetic. Because the box's copy isn't a member of the local card, picking Run on hetzner-devbox takes the else branch in the composer and clones clawnify/taskwindow to ~/taskwindow, beside the ~/TaskWindow the box already has, plus a third project row.

Fix

• Identity comes from the origin URL, not gh repo view. gh needs to be installed, authenticated and online, so a box missing any of the three silently lost its identity. With no argument it also resolves through BaseRepo(), which reports a fork's parent, so two engines could derive two different identities for the same clone. One derivation, offline and instant, used by both the register and repair paths. cloneRepo now reuses the same parser instead of its own inline copy of the regex.
• projects:list repairs the identity before answering, so a repo that gains a remote later heals itself on the next board load. Measured at 30ms for 11 real projects, on a call made at board mount and on connect and never polled, which keeps it well inside the aggregate's 10s merge-read budget. That budget is why detection must not touch the network.
• The repair writes through a new repo.updateProject, not upsertProject, which sets lastOpenedAt and would have reshuffled the sidebar (listProjects orders by it) on every board load.
• The card key is lowercased. Two clones of one repo really do disagree: clawnify/taskwindow locally against clawnify/TaskWindow on the box. GitHub treats those as one repo.

Verification

• Both new tests fail against the old code and pass against the new one, checked by temporarily restoring the old key and the old list handler.
• The repair path was run against a copy of the real desktop database: 11 projects, 30ms, exactly one repair (contaktly gaining Contaktly/contaktly), with row order and every lastOpenedAt unchanged.
• Card keys recomputed from the real origin URLs on the Mac and both boxes produce the intended board: TaskWindow, contaktly and Clawnify each merge Local with hetzner-devbox, Ateam spans all three engines, and the two repos that genuinely have no origin stay honestly separate.
• bun test 400 pass, bun run typecheck clean. The three lint errors in the touched files are byte-identical at main; no new ones, and the unrelated reformats biome wanted were reverted.

Repairs run per engine, so a box's rows heal once that box's server is on a build containing this. Documented in the troubleshooting table.