delivery.repo resolution: three silent-wrong-repository defects found in the #1255 review #1260

Found while reviewing #1255 (merged as 2d3eb88c). None of them blocks that PR — the merge path is right — but each one ends in the same place: the board silently uses the package default (or a wrong URL) instead of the repository the workspace names, and nothing says so. One issue, three items, one small PR.

1. A linked worktree silently falls back to the package default (high)

core/src/host/delivery-repo.js:74-79 (gitConfigPath) reads <gitdir>/config. That is the shape of a submodule, not of a linked worktree: git worktree add keeps config in the common directory, reachable as <gitdir>/commondir → <common>/config. So a worktree checkout with an origin remote produces a failed read, the resolver falls through to the package default, and the page honestly labels it from the package (default) — pointing at the wrong repository.

The comment at delivery-repo.js:16 and the fixture at core/test/delivery-repo.test.js:59 both call that shape a worktree, so the comment and the test name document the wrong shape while the code matches them (and only them).

Fix: read commondir when it exists and take config from there; add a fixture whose .git file says gitdir: … and whose gitdir carries commondir pointing at a directory with the origin URL. Keep the submodule fixture as it is — both shapes are real.

2. OWNER_NAME accepts . and .., so a URL can be built out of dot segments (normal)

core/src/host/delivery-repo.js:24 lets an owner/name be . or .., so parseRepoName('../..') answers ../.. and the board builds a request path that normalises to /repos/../../issues on api.github.com. Same host, so no token leaves — but a repository name should be refused the way a non-github host is, rather than handed to the API.

Fix: reject a component that is . or .. in parseRepoName.

3. The hint and the docs name a setting key the host never reads (normal)

The setting's literal key is config.deliveryRepo (core/src/host/delivery-board.js:764), but the page, the hint and docs/ call it delivery.repo. A user who copies the hint into the plugin entry writes a key nothing reads, gets no warning, and lands on the package default — "configured it exactly as documented" equals "not configured".

Fix: name the literal key in the hint and the docs, or read config.delivery?.repo ?? config.deliveryRepo so the documented spelling works.

Acceptance

One small PR against core/src/host/delivery-repo.js (+ delivery-board.js for item 3) with a test per item, each of which goes red when its fix is removed: the commondir fixture for item 1, parseRepoName('../..') refused for item 2, and the documented spelling resolving for item 3.

Recorded, not an item

On the review host the pin line is skipped pin (no git), so the pin could not be verified there; CI's package job has git and passed on the reviewed tip at 06:41:53Z. Nothing to fix, kept here so the gap is written down.

Evidence for all three is in the #1255 review comment (6410118329).