WIP: Add GitLab repository workspace support

[simple-agent-manager]

WIP / stacking

Stacked on #1545 (sam/gitlab-platform-config-wip). This PR is intentionally draft/WIP.

Do not deploy to staging from this PR yet. Do not mark ready. Do not merge. Staging verification was explicitly skipped by request.

Refs SAM idea 01KV7ZFD6HZS5N7J45VA798KN1 and parent task 01KWYJXQGZMHYE4AQ7VQHE6YGD.

Summary

• Adds GitLab as a repository provider in shared/API/web contracts and project onboarding.
• Adds GitLab project/branch selection routes using the platform-level GitLab OAuth config from WIP: Add GitLab platform OAuth config #1545.
• Stores GitLab repository metadata in a sidecar D1 table and re-verifies GitLab access at project/task/workspace token boundaries.
• Adds GitLab repo browsing support for branches, trees, files, raw files, and compare.
• Threads GitLab clone/provider metadata through task runner, node-agent, VM workspace provisioning, persistence, and recovery.
• Extends the VM credential-helper flow for GitLab host/path-constrained OAuth credentials and provider-aware GitLab merge request creation.
• Keeps GitHub and Artifacts behavior on their existing paths.

Security notes

• GitLab OAuth tokens are not persisted or exported as static workspace env vars.
• GitLab credentials are returned through the workspace callback git-token flow only.
• VM credential responses are constrained by the configured GitLab host and exact repository path with credential.useHttpPath=true.
• GitLab repository metadata stores the bare host required by Git/VM paths while API/OAuth calls continue using the configured platform origin.

Validation

• pnpm --filter @simple-agent-manager/api typecheck
• pnpm --filter @simple-agent-manager/web typecheck
• pnpm --filter @simple-agent-manager/shared typecheck
• pnpm --filter @simple-agent-manager/api test -- tests/unit/services/gitlab.test.ts tests/unit/services/repo-browse-gitlab.test.ts tests/unit/services/repo-browse-github.test.ts
• pnpm --filter @simple-agent-manager/web test -- tests/unit/components/project-onboarding-wizard.test.tsx
• pnpm --filter @simple-agent-manager/api build
• pnpm --filter @simple-agent-manager/web build (passes with existing bundle/dynamic import warnings)
• pnpm --dir apps/api exec eslint 'src/**/*.ts' 'tests/**/*.ts' --quiet
• pnpm --dir apps/web exec eslint 'src/**/*.{ts,tsx}' 'tests/**/*.{ts,tsx}' --quiet
• pnpm --dir packages/shared exec eslint 'src/**/*.ts' 'tests/**/*.ts' --quiet
• /tmp/go1.25.0/bin/go test ./internal/bootstrap
• /tmp/go1.25.0/bin/go test ./internal/persistence
• /tmp/go1.25.0/bin/go test ./internal/gitrepo
• /tmp/go1.25.0/bin/go test ./internal/server -run 'TestHandleGitCredential|TestTryCreateGitLabMergeRequest|TestGitHubTokenFetcherForWorkspace'
• /tmp/go1.25.0/bin/go test ./internal/server -run 'TestCreateWorkspace|TestRecoverWorkspaceRuntime|TestWorkspaceMetadata'
• DOCKER_HOST=unix:///tmp/sam-docker.sock /tmp/go1.25.0/bin/go test ./internal/server after installing Docker locally and starting dockerd on /tmp/sam-docker.sock
• pnpm --dir apps/web exec playwright test tests/playwright/project-onboarding-wizard-audit.spec.ts --project='iPhone SE (375x667)' --project='Desktop (1280x800)'
• git diff --check

Not run / WIP gaps

• No staging deployment and no staging verification, by request.
• Live GitLab OAuth clone/push/MR flow has not been verified against staging credentials because staging was intentionally skipped.
• GitLab-specific member/invite repository access routes and GitLab webhook/task trigger support are deferred.

[codspeed-hq]

Merging this PR will not alter performance

✅ 6 untouched benchmarks

---

_{Comparing sam/gitlab-repo-workspace-wip (3a24e33) with sam/gitlab-platform-config-wip (7220fae)}

[sonarqubecloud]

Quality Gate passed

Issues
19 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.3% Duplication on New Code

See analysis details on SonarQube Cloud