Merge upstream main 98beed1a22 into coder-only

[henrychu04]

Brings coder-only up to upstream/main 98beed1 (65 commits; origin/main was mirrored to the same commit first).

Coder adaptations

• AgentScope (upstream fix(server): agents run in their own systemd scopes so an OOM kill spares the server pingdotgg/t3code#17662) is carried and provided in makeCoderRuntimeLayer. Agents and terminals in the workspace get upstream's oom_score_adj raise, plus systemd scopes when a user manager exists.
• Claude CLI transport: ClaudeAgentSdk/ClaudeCli now pass executableArgs before the CLI's own arguments, as the SDK does. Upstream's AgentScope wraps Claude as /bin/sh … claude, and the transport used to reject that option, so every Claude turn failed after the merge. This was caught in the live smoke; a test now launches the CLI through agentScopeCommand.
• MR watcher freshness (pre-existing): an earlier sync dropped allowStale from PullRequestRef along with cross-environment routing. Upstream's watcher also relies on allowStale: false to read past the held stale-while-revalidate detail, so every wake lagged one 2-minute poll. This PR restores upstream's field, service handling, reactor line, and test. Verified live: a passing pipeline now wakes the thread on the next poll.
• GitManager keeps the GitLab refs/merge-requests fetch and adds upstream's fetch-by-name fallback. Upstream's Azure test now runs on GitLab URLs.
• pullRequests.reportState joins CoderWsRpcGroup for wire parity; its caller, upstream's cross-environment routing, isn't carried.
• Ported: right-panel tab drag reorder, maximize kept per thread, inline MR action confirmations, the MR search caret fix, the cap-aligned branch label, and the "Version" settings search row. All use GitLab wording.
• Not carried: GitCafe, .icns project icons (no project favicons), the Claude organization id (it only keys usage accounts), update-track settings, and desktop/mobile changes.
• Restores two PullRequestService state-announcement tests lost in an earlier sync. ThreadStatusIndicators and settingsSearch tests are adapted to GitLab-only hosts and no update track.

Checks

• typecheck: gateway, helper, server, web, plus contracts, shared, client-runtime, coder-cli, provider-* and source-control-*.
• pnpm test:coder has two known failures:
  • storageCleanup "aggregates expired artifacts": the known macOS /private/var TMPDIR issue; it passes with a realpath TMPDIR.
  • ProjectionRecovery "selects unfinished recovery work without reading settled thread histories": fails identically on a clean upstream/main checkout (Node 24.12). It's an upstream bug, left unfixed.
• pnpm knip:check and pnpm build pass.
• Live smoke (real Coder workspace, fake claude, smoke-only fake glab):
  • Claude turn through AgentScope.
  • Terminal through AgentScope (oom_score_adj = 800).
  • Tab drag reorder and maximize persistence.
  • Settings search finds Version.
  • MR list, search caret, detail checks running → passed, inline "Confirm auto-merge?" and "Confirm merge?", merge.
  • link_pull_request + watch_pull_request over the bridge: thread row and wake on pass.
  • PDF preview rendered in full headless Chrome's built-in viewer.

🤖 Generated with Claude Code