Move AutoRespond CLI name selection to CodeBackend (#412)

[dgershman]

Summary

• AutoRespondCoordinator selected the CLI binary name (gh vs glab) with six inline provider == .gitlab ? "glab" : "gh" / if provider == .gitlab checks. With the TaskBackend / CodeBackend split from Extract TicketBackend protocol — decouple gh/glab shell-outs from call sites #410 / ADR 0005 in place, this belongs on the backend.
• Add cliName: String to CodeBackend; implement "gh" on GitHubCodeBackend and "glab" on GitLabCodeBackend.
• Inject ProviderManager into AutoRespondCoordinator; resolve a CodeBackend per session via session.codeProvider ?? session.provider (the convention from Session.swift / Add Session.codeProvider for cross-backend pairing #420). Corveil-or-unknown sessions fall back to GitHub tooling — matches the prior ?? .github default.
• Change AutoRespondPrompts.build and QuickActionPrompts.build to take a CodeBackend instead of a Provider. Prose branches still read codeBackend.provider; CLI tokens read codeBackend.cliName.

Prompt text is byte-identical for every existing branch (cliName returns the same string previously hardcoded), so no behavior change.

Test plan

• swift build --arch arm64 — clean
• swift build --arch arm64 --build-tests — clean (QuickActionPromptsTests, AutoRespondCoordinatorReviewSessionTests updated to construct CodeBackend / ProviderManager)
• rg 'provider == \.gitlab \? "glab" : "gh"' Sources/ Packages/ Tests/ returns zero matches
• Test bundle execution blocked locally by swiftpm-xctest-helper being x86_64-only on this Xcode install (build is arm64); CI runs the suite.

Closes #412

[dhilgaertner]

Code & Security Review

Critical Issues

None.

Security Review

Strengths:

• Pure internal refactor — no new external input, network, auth, or filesystem surface. CLI tokens (gh/glab) are compile-time constants on each backend, not user-controlled, so no command-injection vector is introduced.
• PR URLs interpolated into prompt hints were already interpolated identically before this change; no new injection path.

Concerns:

• None.

Code Quality

• Behavior parity confirmed. cliName returns the exact strings (gh/glab) previously hardcoded, and the prose branches still key off codeBackend.provider, so prompt text is byte-identical for every existing branch. Verified the GitLab fixChecks/mergePR/fixConflicts and GitHub changesRequested branches all reduce to the prior literals.
• Force-unwrap is safe. providerManager.codeBackend(for: .github)! in resolveCodeBackend can never trap — ProviderManager.codeBackend(for:) returns nil only for .corveil; .github always yields a GitHubCodeBackend. The fallback is documented inline.
• Provider resolution matches convention. session.codeProvider ?? session.provider ?? .github mirrors the established pattern at SessionService.swift:1210 and the Session.swift doc contract (#420 / ADR 0005).
• Concurrency correct. codeBackend(for:) is nonisolated, so the @MainActor coordinator calls it synchronously without await — appropriate.
• All call sites updated (AppDelegate injects the existing providerManager; both test suites migrated to CodeBackend); rg confirms zero remaining inline provider == .gitlab ? "glab" : "gh" checks.
• Test stub FakeCodeBackend is appropriately minimal — only provider/cliName are read by the builders.

Note: the resolved CodeBackend is built with host: nil, so a self-hosted GitLab session's host isn't threaded through. This is harmless here because prompt rendering only reads cliName and provider (never linkedPR/ensureMergeLabel), but worth keeping in mind if these backends ever get used for live calls in this path.

Summary Table

Color	Meaning	Verdict effect
Red	Must fix	Request changes
Yellow	Should fix	Request changes
Green	Consider	Approve allowed

Recommendation: Approve — driven by [0 Red, 0 Yellow, 1 Green] findings. Behavior-preserving refactor that correctly moves CLI-name selection onto CodeBackend, consistent with ADR 0005 and #420.

🐦‍⬛ Reviewed by Crow via Claude Code