feat(cli): create GitLab merge requests for verified patches

[kmbroai]

Summary

patch --create-pr currently invokes GitHub's CLI for every repository. It now creates a draft GitLab merge request with glab when the origin push URL identifies GitLab.

Changes

• Support GitLab.com and self-hosted GitLab through the existing GITLAB_HOST setting (including glab's GITLAB_URI and GL_HOST aliases).
• Bind the merge request's source and target projects to the origin push URL, including SSH remotes and subgroup paths.
• Reuse verified patch commits, patch-risk summaries, and patch --resume-pr recovery. Preserve the pullRequest: { branch, url } JSON result and existing GitHub arguments.
• Update command help, the interactive patch browser, documentation, and publication/retry regression tests.

Testing

• bun test --timeout 30000 tests-ts/cli-patch.test.ts --seed 12345: 42 passed, 0 failed.
• pnpm run types and pnpm run format passed.
• Hosted CI is running for the updated commit.

Risk and rollout

The existing --create-pr and --resume-pr syntax and defaults are unchanged. GitLab requires an installed, authenticated glab; self-hosted repositories also require the matching GitLab host setting when creating or resuming publication. Other hosts retain the GitHub workflow. GitLab API calls are mocked in regression tests; no live merge request was created during validation.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-04T23:49:29.271521Z	72a0ba9	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[faizan-oai]

Excellent! Waiting for phabricator and bit bucket support ty

[mldangelo-oai]

Non-blocking deslop follow-up: these two test reductions preserve the distinct GitLab coverage while removing duplicated setup and workflow runs.

[mldangelo-oai]

[P3] Keep the routing matrix focused

These nine rows test origin/environment-to-client routing, but each also runs the unrelated patch-risk assessor and checks its summary. Patch-risk publication is already covered above. Drop --assess-patch-risk and the assessor fixture here, and assert the default MR body instead.

[mldangelo-oai]

[P3] Drop the duplicate GitLab retry rows

The GitLab push/create rows exercise the same provider-neutral retry state machine already covered by GitHub. The routing matrix below verifies glab’s list/create arguments, while the missing-client row drives the GitLab list → resume → push/create → repeat path. Keep that row and delete these two duplicate failure rows.