feat(bootstrap): GitLab-aware forge tools/auth

[CodeFunta]

Summary

Add a thin Firstmate-local forge provider boundary so GitLab-only homes no longer fail bootstrap on unconditional gh / gh-axi / gh auth status checks.

This is a narrow Phase 0–2 slice of GitLab support (bootstrap tool + auth requirements), not full merge/teardown/review parity.

Related: kunchenguid#695

Motivation

On a registry that only contains GitLab projects, fm-bootstrap.sh currently always requires GitHub tooling and gh auth status. That blocks legitimate GitLab-only setups even when glab is installed and authenticated.

no-mistakes already owns MR create/update/CI for GitLab via glab. Firstmate only needs to stop assuming GitHub at bootstrap.

Changes

1. New bin/fm-forge-lib.sh

   • fm_forge_detect_provider — classify checkout remotes as github|gitlab|local|unknown (unknown hosts fail closed)
   • fm_forge_resolve_host — resolve SSH aliases / URLs to a hostname
   • fm_forge_require_cli / fm_forge_check_auth — provider-scoped CLI + auth checks
   • fm_forge_scan_registered_projects — union of providers/hosts under $PROJECTS
   • Self-managed GitLab hosts are explicitly opted in through FM_GITLAB_HOSTS (comma-separated; defaults to gitlab.com)

2. bin/fm-bootstrap.sh

   • Source fm-forge-lib.sh
   • Build COMMON_TOOLS forge CLIs from detected providers:
     • GitHub projects → gh + gh-axi
     • GitLab projects → glab
     • mixed → union
   • Replace unconditional gh auth status with per (provider, host) auth checks

Non-goals (intentionally out of scope)

• GitLab merge / teardown / review-diff parity inside Firstmate
• Fork-MR workflows
• Changing no-mistakes or gh-axi
• Renaming persisted pr= fields

Those remain with existing paths (no-mistakes + raw glab where already used for watch/poll).

Test plan

• Fresh clone on current main; apply patch cleanly
• GitLab-only $PROJECTS registry:
  • bootstrap does not print MISSING: gh / MISSING: gh-axi
  • bootstrap does not print NEEDS_GH_AUTH when only GitLab is present
  • with glab missing → reports glab requirement
  • with glab present but unauthenticated for host → NEEDS_GLAB_AUTH
• GitHub-only registry still requires gh / gh-axi / gh auth
• Mixed registry requires union of both
• unknown/local projects do not force a forge CLI
• shellcheck (if project CI runs it) on fm-forge-lib.sh + fm-bootstrap.sh

Notes for reviewers

• Built against firstmate main at the time the kit was exported; if COMMON_TOOLS / gh auth status lines moved, re-apply using the anchor notes in the kit README.
• Self-managed GitLab hosts are opt-in via FM_GITLAB_HOSTS; unknown hosts fail closed as unknown.
• Design reference: open issues/PRs around GitLab forge support (Support GitLab as a forge via glab kunchenguid/firstmate#695 and related); this PR does not attempt to merge older large draft PRs unchanged.

[CodeFunta]

Superseded by the correctly-targeted upstream PR: kunchenguid#1560