[Bug] Workspace resync ignores repo settings exclude paths for Code Health and refactoring

[joptimus]

Describe the Bug

In workspace mode, if a repo has exclude_patterns set in the repo settings, a workspace resync does not fully honor them for Code Health and refactoring targets.

Excluded files can still show up in health findings and refactoring targets after resync.

Steps to Reproduce

1. Run repowise update --repo <alias> so a workspace repo is indexed.
2. In the web app, open that repo's settings and set exclude_patterns to something like tools/.
3. Make sure there are files under that excluded path that would produce Code Health findings.
4. Trigger a workspace resync for the repo from the workspace UI.
5. Open Code Health or Refactoring Targets for that repo.

Expected Behavior

Files matching the repo's excluded paths should not be re-indexed or shown in Code Health and refactoring results after resync.

Actual Behavior

After workspace resync, excluded files can still appear in Code Health findings and refactoring targets.

No API error is shown. The problem looks like the wrong exclude source is being used during the workspace resync path.

Environment

• OS: Windows 11
• Python version: 3.14.2
• Repowise version: 0.20.0 (repowise --version)
• Installation method: source checkout via uv run

Additional Context

This seems specific to the workspace update path.

The server job path correctly merges excludes from both Repository.settings_json and .repowise/config.yaml, but the workspace incremental update path only reads .repowise/config.yaml excludes and does not read the DB-backed repo settings excludes from the web UI.

There also appears to be a second issue: the workspace incremental persistence path is upsert-only for health data, so rows for files that become excluded can linger until a full prune path runs.

[joptimus]

Likely root cause from local tracing:

• The server job path does merge excludes from both Repository.settings_json and .repowise/config.yaml in packages/server/src/repowise/server/job_executor.py around _repo_exclude_patterns() and then passes them into run_pipeline().
• The workspace update path does not do that. In packages/core/src/repowise/core/workspace/update.py, _incremental_repo_update() only builds merged_excludes from load_repo_config(repo_path) plus explicit function args. It never reads DB-backed repo settings from Repository.settings_json.
• That means repo settings excludes set in the web UI are not part of workspace incremental resync.
• There also looks like a second issue in the same flow. The incremental persistence path in packages/core/src/repowise/core/pipeline/incremental.py is upsert-only for partial health writes, so files that become excluded can leave old health/findings rows behind until a full prune path runs.
• The code health/refactoring API seems to just read persisted health rows, so it looks more like stale or incorrectly persisted data than a filtering bug in the endpoint itself.

I also ran the closest existing tests locally:

• tests/unit/server/test_job_executor.py
• tests/unit/workspace/test_incremental_update.py

They pass, which suggests the current gap is missing coverage for workspace resync using DB-backed repo settings excludes.