PR-head config: extend same-repo detection to GitLab MRs + Bitbucket PRs (#223 follow-up)

Follow-up to #223 (same-repo PR-head config, GitHub-only). Extend the head-config path to GitLab merge requests and Bitbucket pull requests.

Why this is smaller than it looks

Most of #223 is already provider-agnostic:

• Config fetch — configsync.MultiFetcher.Fetch already switches on source.Provider and has working gitlab.FetchGocdnextFolder / bitbucket paths (configsync.go:158-182). No new fetch code needed.
• Store barrier / resolver / binding lookup / wiring partition — CreatePRHeadRun, resolvePRHeadPlan, FindPRHeadBindingsByURL (by normalized URL), and applyPRHeadConfig's partition are all provider-neutral.

The only missing piece is a same-repo (same-project) predicate per provider, threaded into pullRequestEvent.SameRepo.

The gap

Today the gate is GitHub-only:

• pr_head_dispatch.go:67 — if ev.Provider != "github" || !ev.SameRepo.
• SameRepo is derived + set only in the GitHub handler (handlePullRequest), via immutable repo ids (sameRepoGitHub). The GitLab and Bitbucket handlers never set it.

Work

1. GitLab same-project predicate. The MR event carries object_attributes.source_project_id and target_project_id, but ParseMergeRequestEvent doesn't capture them yet. Add them and a sameRepoGitLab(sourceProjectID, targetProjectID, projectID) mirroring sameRepoGitHub: true only when all ids are present (non-zero), consistent, and source == target. A fork MR (source_project_id != target_project_id) → false.
2. Bitbucket same-repo predicate. The PR event carries source.repository.uuid and destination.repository.uuid; the parser captures neither today. Add them and sameRepoBitbucket(sourceUUID, destUUID) — equal (and non-empty) → true; a fork PR → false.
3. Thread SameRepo into pullRequestEvent from both handlers (the field already exists; only the GitHub handler sets it).
4. Relax the gate. Once SameRepo is provider-uniform, drop the hard-coded ev.Provider != "github" and gate on !ev.SameRepo alone — binding lookup and fetch already handle every provider. The head SHA for the fetch is already on pullRequestEvent.HeadSHA for all three providers.

Fail-closed principle (carry over from #223)

Same-repo is decided only by immutable provider ids — never URL or name (a contributor controls both). Any missing, zero, or inconsistent id → false, so a fork or a malformed payload can never be mistaken for same-repo.

Tests

• Parser tests: id extraction for GitLab (source/target_project_id) and Bitbucket (source/destination repo UUID); missing → same-repo false.
• HTTP-boundary tests mirroring the GitHub matrix, per provider: same-repo + toggle-on → runs the head jobs; fork → base + zero fetch; toggle-off → base.

Notes

• GitLab already reuses on: [pull_request] as the event name (the webhook is the provider boundary) — no schema change for users.
• Bitbucket Cloud has no PR-label primitive (unchanged; unrelated to this).

Start in pr_head_dispatch.go at the provider gate, then trace ParseMergeRequestEvent, the Bitbucket parser, and the provider handlers alongside sameRepoGitHub. Run the parser and HTTP-boundary tests described in the issue; done means same-repository GitLab and Bitbucket events run head jobs, while forks, missing IDs, and the disabled toggle use the base path without fetching head config.