feat: add GitLab-aware forge bootstrap boundary

[CodeFunta]

Intent

Continue PR #1560 for the GitLab bootstrap provider boundary. Preserve the existing implementation, update the feature branch onto the latest main branch, resolve only genuine merge conflicts, push the updated branch, and monitor the PR until merge.

What Changed

• Added registered-project forge detection for GitHub, GitLab, self-managed GitLab hosts, local origins, and unsupported remotes.
• Updated bootstrap diagnostics and tool/auth requirements to use host-scoped GitHub or GitLab CLI checks instead of unconditional GitHub requirements.
• Documented forge configuration and diagnostics, and added coverage for remote classification, provider requirements, and authentication handling.

Risk Assessment

✅ Low: The provider-aware bootstrap change is bounded, fail-closed for unsupported remotes, and covered by executable behavior tests; the only identified issue is an unused helper that does not affect runtime behavior.

Testing

Ran the focused bootstrap behavior suite against the changed implementation; all provider-boundary scenarios and related bootstrap contracts passed. The suite produced reviewer-visible CLI test evidence, and the worktree remained clean. No UI surface exists for this change, so screenshots were not applicable.

Evidence: Focused bootstrap provider-boundary test results

ok - bootstrap reports treehouse lease + tasks-axi/quota-axi bootstrap contracts
ok - bootstrap enforces no-mistakes minimum version
ok - bootstrap enforces gh-axi minimum version
ok - bootstrap enforces lavish-axi minimum version
ok - bootstrap enforces tasks-axi minimum version
ok - bootstrap enforces quota-axi minimum version
ok - bootstrap requires git with an install instruction
ok - bootstrap: backend=orca gates the Orca CLI without requiring it on the default backend
ok - bootstrap: session-provider backends require their own CLI + jq + treehouse, never tmux
ok - bootstrap: a session-provider backend gates its own CLI, never a false tmux requirement
ok - bootstrap: Herdr manual-install guidance is never executed as a shell command
ok - bootstrap keeps origin-only local semantics and owns forge remediation
ok - bootstrap: the bundled cmux CLI satisfies the active backend dependency
ok - bootstrap: unknown resolved backends fail closed with an actionable diagnostic
ok - bootstrap: JSON-emitting backends require jq (their genuine dep), never tmux
ok - bootstrap: the treehouse lease check follows the resolved backend's worktree provider
ok - bootstrap computes a fleet-size-aware default timeout and preserves partial fleet-sync output
ok - bootstrap keeps the quick 20s default for small fleets
ok - bootstrap preserves FM_FLEET_SYNC_BOOTSTRAP_TIMEOUT as an explicit override
ok - bootstrap treats a blank timeout override as unset
ok - bootstrap computes the timeout before launching fleet sync
ok - bootstrap keeps routine tasks-axi, harness, dispatch, and already-live liveness confirmations silent
ok - bootstrap routine contract runs under system /bin/bash
ok - bootstrap surfaces active crew-dispatch rules only as verbose BOOTSTRAP_INFO
ok - bootstrap validates crew-dispatch.json and reports malformed or unverified configs

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

⚠️ **Rebase** - 1 warning

• ⚠️ bin/fm-bootstrap.sh - merge conflict rebasing onto origin/main

⚠️ **Review** - 1 info

• ℹ️ bin/fm-forge-lib.sh:147 - The newly added fm_forge_require_cli function is never called; bootstrap independently derives and checks the same provider CLI requirements. Remove this dead helper or make bootstrap use it so the provider-boundary contract has one implementation.

✅ **Test** - passed

✅ No issues found.

• bash tests/fm-bootstrap.test.sh
• End-to-end bootstrap scenarios covering GitLab-only, GitHub-only, unknown, HTTPS, SSH/scp-style, local, and upstream-only remotes
• Provider-specific CLI and authentication diagnostics, including GitLab host normalization and glab requirements
• Bootstrap backend and dependency behavior using hermetic fake toolchains

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[kunchenguid]

Automated reminder: thanks for the PR! This branch currently has a merge conflict with the base branch.

When you get a chance, please rebase onto (or merge) the latest base branch, resolve the conflict, and push. After that, checks will re-run and the PR will get looked at again.

_{Noted for firstmate#1560 at e03d829a.}

[kunchenguid]

Automated reminder: thanks for the PR! This branch currently has a merge conflict with the base branch.

When you get a chance, please rebase onto (or merge) the latest base branch, resolve the conflict, and push. After that, checks will re-run and the PR will get looked at again.

_{Noted for firstmate#1560 at 1634739b.}