feat(git-providers): the task board and the PR panel speak both providers

[viktormarinho]

Stacked on #7015. Phase 3 of making Studio work on GitLab: after the sandbox
(#6939) and the CMS (#7015), this is the task board and the change-request
panel — the last two surfaces that were GitHub by construction.

The interface

A change request — a pull request on GitHub, a merge request on GitLab — is the
same object on both: a numbered proposal with a lifecycle, a mergeability, some
CI and some comments. ChangeRequestClient states exactly that. Nothing in it
names a pull request, a check run, a pipeline or a job.

read(number)                          // one cheap call, for the sweeps
readDetailed({ number } | { branch }) // everything a review surface draws
listOpen(limit) / lastMergedInto(base)
open(params) / describe(number, body)
merge(number, { strategy })           // never throws for a refusal
readCheckLog(checkId) / readDeployedUrl(sha)

The cheap read and the detailed one are separate methods rather than one with a
flag, because the callers are budgeted in reads, not in round-trips: the
review sweep reads every candidate card on a timer, and that multiplier is what
held the GitHub App's rate limit shut for 17 hours once.

Call counts differ and that is fine — GitHub folds the detailed read into one
GraphQL query, GitLab needs a handful of REST hops.

Why the board could not see a GitLab MR

Both the board and the panel reached GitHub through the mcp-github MCP server
and named its tools — pull_request_read, merge_pull_request,
list_pull_requests, GET_CHECK_RUN — from the server and from the
browser. A GitLab project had nothing to call, so its merge request never
reached a card: no review cycle, no auto-merge, no publish.

What the interface bought beyond GitLab

• One detailed read replaces four to six. The MCP path made a get, a
  get_status, a get_check_runs and a get_comments per card, whose answers
  described four different moments. GitHub's rollup carries commit statuses and
  check runs together and both map to one CheckRun, which is what collapsed
  two of those reads into none.
• A refusal is classified where its vocabulary lives. GitHub answers 405
  for a forbidden merge method, a conflict and a branch rule alike, so the merge
  ladder and the classification moved into the GitHub implementation — and
  conflict came back as a first-class outcome. The approval path now drops one
  mergeability read per merge, plus the phrase-matching that stood in for it.
• The read cache stores neutral shapes, keyed by repository rather than by
  connection. A busy repository's raw comments payload ran past the cache's
  value cap, so its put was rejected and that change request missed on every
  read, forever.
• No client lifetime to manage. The provider clients are stateless HTTP, so
  the MCP dance of keeping a client open for background revalidation is gone —
  along with the bug where closing eagerly killed every refresh.

Identity is the URL

It carries the host, so it names the provider, and it is the only shape a GitLab
project nested in subgroups fits. linkPr takes a RepoRef and derives both
the legacy owner/name split and repository_id at the write, so every
caller — the tool hook, a bash-output scan, a pasted URL — records the
credential without knowing it has to.

The browser stops speaking GitHub

CHANGE_REQUEST_STATE / LAST_MERGED / LIST_OPEN / CHECK_LOG / OPEN / MERGE and
REPOSITORY_SEARCH_BRANCHES are Studio tools over the interface, replacing the
GitHub-named ones and the browser's direct MCP calls. Branch browsing and branch
search were two paths (a paged MCP list_branches plus a GitHub-only search
tool) and are now one call with a cursor.

Site Editor no longer opens GitLab projects on Chat: reading the decofile and
opening a change request both go through the interface now, so the gate #7015
left behind is gone.

Testing

• 1404 unit tests across the touched areas, 0 failures — including new mapping
  suites next to each implementation (change-requests/{github,gitlab}.test.ts)
  and the shared reducer's own.
• 255 e2e passed, 10 skipped. New black-box coverage in
  task-board-pr-link.spec.ts: a GitLab merge request nested in subgroups links
  with every namespace level intact, a sub-path URL still resolves, and neither
  provider's issue URL is accepted. The one failure,
  mcp-proxy-roundtrip, is pre-existing (verified on a clean origin/main in
  feat(git-providers): the CMS reads and writes through a provider interface #7015).
• check, fmt, lint, knip clean.

Known limits

• The Changes tab's fallback diff — used only when the sandbox has no diff
  of its own — still walks GitHub's contents API per file, so a GitLab project
  shows the sandbox diff alone rather than erroring. Making it neutral needs a
  compare-plus-blobs tool; RepoContentClient.compareDetailed is already the
  right seam for it.
• A GitLab repository has no legacy-connection path. That is correct: it never
  had one, and resolveLegacyGithubConnection answers null for a non-GitHub ref
  rather than borrowing a GitHub installation that cannot see it.
• Still reconcile-on-view, not webhooks — unchanged by this PR, and now stated
  in provider-neutral terms so a merge_request hook can join the same path.

---

Summary by cubic

Opens the task board and change-request panel to GitLab alongside GitHub, completing the last two Studio surfaces that were GitHub by construction. Both now go through a provider-neutral ChangeRequestClient with GitHub and GitLab implementations, replacing the browser's direct mcp-github calls and GitHub-only tools; GitLab merge requests now flow through review, auto-merge, and publishing the same way pull requests do. Also fixes the repository import flow, which 400'd on every import while the picker closed as though it had worked.

What changed

• CHANGE_REQUEST_STATE, CHANGE_REQUEST_OPEN, CHANGE_REQUEST_MERGE, and REPOSITORY_SEARCH_BRANCHES are new Studio tools over the interface, replacing GITHUB_PR_STATE, GITHUB_LAST_PUBLISHED_PR, GITHUB_SEARCH_BRANCHES, and the MCP pull-request calls.
• Merge refusals are classified inside each provider, so conflict is now a first-class merge outcome instead of phrase-matching a 405; the approval path drops one mergeability read per merge.
• The read cache stores neutral shapes keyed by repository instead of by connection, fixing rejected payloads on busy repositories.
• The repository import payload now always carries connections (empty when the repo has none), which was the missing field behind that silent 400; the error states distinguish "no account", "no legacy connection", and "dead token", and the import button copy is neutral instead of naming GitHub.
• Branch browsing and search collapse into one paged server call with a cursor.
• Provider code now lives one directory per provider — git-providers/github/ and git-providers/gitlab/ — with provider state (App signer, env config, legacy connections) moved in beside it and git-providers/index.ts as the only entry point; a new lint rule makes that boundary a build error, catching GitLab importing GitHub's CI summarizer (now hoisted to the shared contract). A GitHub App whose private key can't sign is treated as unconfigured, so a mangled PEM leaves the App dormant instead of routing every org to it.

Known limits

• The Changes tab's fallback diff still walks GitHub's contents API when the sandbox has no diff; a GitLab project shows its sandbox diff alone.
• The board still reconciles on view rather than via webhooks, though the hook path is now stated in provider-neutral terms.

^{Written for commit c0b73c2. Summary will update on new commits.}