Add Session.codeProvider for cross-backend pairing

[dgershman]

Closes #414

Summary

Follow-up to #410 / ADR 0005. Adds Session.codeProvider: Provider? so a Corveil-tasked session can pair with a GitHub or GitLab CodeBackend — the protocol split from #411 already supported this in principle; the model now represents it.

nil means "follow provider"; callers resolve with session.codeProvider ?? session.provider. No persisted-state migration: legacy sessions decode codeProvider = nil and the lookup-site fallback routes them to the same backend they used pre-split.

Changes

• Session model — new optional field, init parameter, and decodeIfPresent in the custom decoder (same pattern as lastReviewedHeadSha / autoMergeEnabledAt).
• SessionService.findPRLink — takes an explicit provider: parameter; sole caller in recoverOrphan passes session.codeProvider ?? session.provider ?? .github. The in-line gh pr list shell-out fallback (only reached when no ProviderManager is wired) stays GitHub-only — unchanged.
• Tests
  • SessionModelTests — extends round-trip / nil-defaults / default-values tests; adds sessionBackwardCompatDecodingWithoutCodeProvider for legacy JSON.
  • SessionRepositoryTests.savePreservesAllOptionalFields — round-trips codeProvider: .gitlab alongside provider: .github to prove the field is independently persisted.

IssueTracker is intentionally unchanged: all three of its session.provider reads are task-backend / issue-lifecycle decisions, not codeBackend lookups.

Test plan

• swift test --package-path Packages/CrowCore --filter SessionModelTests — 16 tests pass (incl. new backward-compat decode).
• swift test --package-path Packages/CrowPersistence --filter SessionRepositoryTests — 11 tests pass.
• swift test --package-path Packages/CrowProvider --filter BackendsTests — sanity check on factory; 15 tests pass.
• swift build --arch arm64 — clean build, no callers broke.
• Manual smoke: open existing state.json from a pre-CROW-414 Crow build — confirm sessions hydrate with codeProvider == nil and PR discovery still finds the right backend.

🤖 Generated with Claude Code

[dhilgaertner]

Code & Security Review

Critical Issues

None.

Security Review

Strengths:

• No new external input, shell surface, or credential handling. codeProvider is an internal Provider enum routed only to ProviderManager.codeBackend(for:); the inline gh pr list shell-out fallback is unchanged and still GitHub-only.
• Backward-compatible decoding via decodeIfPresent — legacy state.json without codeProvider decodes to nil with no migration, no crash (verified by sessionBackwardCompatDecodingWithoutCodeProvider).

Concerns:

• None.

Code Quality

• Model (Session.swift): codeProvider follows the exact established pattern for optional fields — synthesized CodingKeys/encoder pick it up automatically, custom decoder mirrors lastReviewedHeadSha/autoMergeEnabledAt. Clean.
• findPRLink (SessionService.swift:1147): confirmed to be the only code-backend resolution site in the app (grep of codeBackend(for). Parameterizing it completes the scope; resolution session.codeProvider ?? session.provider ?? .github is correct, and codeBackend(for: .corveil) safely returns nil.
• recoverOrphan behavior change: the lookup shifts from hardcoded .github to ticket.provider. This is an improvement, not a regression — a GitLab-ticketed orphan now queries the GitLab backend instead of GitHub, matching ADR 0005 intent.
• IssueTracker left unchanged: verified the three session.provider reads (ticket-URL provider resolution :1490, closed-issue completion :2319, markInReview gating :2547) are all task-source / issue-lifecycle decisions — none are code-backend lookups. Correctly out of scope.
• Tests: round-trip, nil-defaults, and independent-persistence (codeProvider: .gitlab alongside provider: .github) all cover the field well. Ran locally: SessionModelTests (16 pass), SessionRepositoryTests (11 pass).

Summary Table

Color	Meaning	Verdict effect
Red	Must fix	Request changes
Yellow	Should fix	Request changes
Green	Consider	Approve allowed

Recommendation: Approve — driven by [0 Red, 0 Yellow, 0 Green] findings. Small, focused, well-tested follow-up that faithfully implements ADR 0005 / CROW-414 with full backward compatibility.

🐦‍⬛ Reviewed by Crow via Claude Code