Rebuilt from fixfon’s proposal in #20241; URL provenance follow-up remains unpublished.

Resolve conflicts against main's GitLab provider, PR service and MCP
pull request tool changes:

- Reapply GitLab project resolution as one wrapper over every provider
  method that takes a repository ref, including the reads and writes
  main added (labels, authors, references, summaries, file stats).
- Keep main's GitCafe URL canonicalization and subagent `next` hints;
  bulk link_pull_requests records the supplied URL as provenance too.
- Only resolve repository-only links on the project's own GitLab host,
  so links to other hosts keep being built without a host read.
- watch_pull_request carries an existing link in its command, so an
  unlink racing the call cannot leave the watch unstarted.
- Leave the checkout URL out of canonical refs: list-seeded previews
  stay keyed the same as direct reads, and the provider call still
  receives the checkout URL through requireProject.
- Replace the raw glab fixture test with a provider test that covers
  resolution, its cache, raw selectors and a failed resolution.

AI-assisted; verified with the tests and tools listed above.

…t URL

resolveLink read the merge request with webUrl: null, which marks a raw
API selector. On a checkout under a path prefix, that read the prefixed
path literally instead of resolving the project through glab. Leaving
webUrl unset lets the project's own repository inherit its HTTP checkout
URL, while other repositories already drop it.

AI-assisted; verified with the tests and tools listed above.

The detail panel asks by host, repository and number alone. On an SSH
checkout of a GitLab served under a path prefix, the repository parsed
from the MR URL includes the prefix, so the panel's reads went to that
literal path and failed with a 404 while the watch reactor, which sends
the link's URL, resolved the right project. The service now remembers
the URL a read supplies for a repository and uses it for later reads of
that repository that supply none. Raw selectors (null) stay raw.

AI-assisted; verified with the tests and tools listed above.

…orking URLs

- Repository-only link_pull_request and watch_pull_request no longer read
  the host first: as on main, the repository is a raw selector, and only a
  supplied URL becomes the link's authoritative URL.
- The service learns a repository's URL only after a read through it
  succeeds, so a failed URL cannot displace working routing.
- A learned URL is part of a read's cache identity, so a read held from
  the raw project is not served once the route changes.

AI-assisted; verified with the tests and tools listed above.