VCS PR lifecycle ingestion: equalize GitLab + Bitbucket with GitHub

Follow-up to #122 (#112 phase 1), which landed PR lifecycle ingestion (opened_at / approved_at / merged_at / merge_sha → vcs_pull_requests) for GitHub only. This issue tracks bringing GitLab and Bitbucket to parity so DORA lead-time decomposition (Coding / Review stages) works regardless of provider. Do it when there's a real need (a GitLab/Bitbucket user wants the bottleneck card).

Scope

Mirror the GitHub work in the existing provider-uniform webhook path:

• GitLab (merge_request + approval events):
  • merge_request payload → opened_at (object_attributes.created_at), merged_at + merge SHA (merge_commit_sha on action merge).
  • Approvals: the Merge request approval webhook (object_attributes.action = 'approved') → approved_at. (GitLab emits approvals on the same MR hook with an approved action, or a dedicated event depending on version — confirm.)
  • Repo key: project.path_with_namespace.
• Bitbucket (pullrequest:* events):
  • pullrequest:created → opened_at; pullrequest:fulfilled → merged_at + merge hash.
  • pullrequest:approved → approved_at.
  • Repo key: repository.full_name.

Implementation notes

• The store layer (RecordPullRequest{Opened,Approved,Merged}) and the vcs_pull_requests table are provider-agnostic already — pass provider = 'gitlab' | 'bitbucket'. Only the parsers + the webhook routing/dispatch need new code.
• Add the lifecycle persistence alongside the existing handleGitLabMergeRequest / handleBitbucketPullRequest (mirror recordGitHubPR), and route the new approval events.
• Parser unit tests + an end-to-end handler test per provider (mirror pr_lifecycle_test.go).

Done when

GitLab and Bitbucket PRs/MRs populate the same lifecycle timestamps as GitHub, with tests, so the phase-2 correlation + bottleneck card are provider-uniform.

Refs #112, #122.

Start by reading the existing handleGitLabMergeRequest and handleBitbucketPullRequest paths, then compare them with recordGitHubPR and pr_lifecycle_test.go. Confirm the provider-specific approval webhook payloads before adding parser and handler coverage. Done means both providers persist opened, approved, and merged timestamps plus merge identifiers, with parser and end-to-end tests.