feat: add multi-provider source-control support

[RedStar071]

Evolve the GitHub-only adapter boundary into a provider-neutral
source-control package with adapters for GitHub / GitHub Enterprise,
GitLab / Self-Managed, Bitbucket Cloud, Bitbucket Data Center, and
Gitea / Forgejo, per the v0.5 milestone (#14).

Boundary: packages/github becomes packages/source-control. Shared
contracts (SourceControlProvider, ProviderCapabilities,
ChangeRequestRef, RunOutcome, StatusPublication) keep provider payload
shapes, event names, URLs, and credentials at the integration boundary;
the agent runtime keeps consuming only @agent-zero/shared types.

Safety: every adapter authenticates the raw webhook body before
parsing (HMAC-SHA256 or constant-time shared-token compare), bounds and
attributes untrusted feedback, defaults parsed events to observe mode
so a webhook can never escalate a run, and suppresses self-replies via
ignoreAuthors. Status credentials travel only as Authorization headers
and are redacted from raised errors. Capability detection makes
unsupported features degrade explicitly: providers without a neutral or
action-required status report the mapping in StatusPublication.degraded
instead of lying, GitLab's missing diff base yields no fabricated
pull-request range, and bodyless change-request signals are ignored
rather than invented.

The oRPC server now routes inbound deliveries by provider headers, so
one deployment can accept webhooks from several configured providers,
each with its own secret; evidence publishing resolves the adapter from
the change-request reference and its per-provider token variable.

A framework-free conformance suite runs every adapter through the same
recognition, forgery-rejection, normalization, self-reply, junk-payload,
observe-by-default, credential-hygiene, and explicit-degradation checks
from authentic signed fixtures.

Verification: 121 package tests (conformance plus adapter suites) and
68 server tests pass; typecheck, oxlint type-aware lint, oxfmt, build,
and check:repo pass locally for the affected packages.

Closes#14

Co-Authored-By: Claude Fable 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01MJQxEwqaaP4aMG4E7yeaky

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Confidence Score: 5/5

No blocking failure remains.

Execution confirmed that Bitbucket Cloud and Bitbucket Data Center independently resolve their configured credentials and use them only for their respective status-publication requests.

T-Rex Logs

What T-Rex did

• Executed a focused runtime harness that compared the prior Bitbucket token mapping with the current environment resolution and invoked both Bitbucket status adapters.
• The results show that the prior mapping resolved both Bitbucket products from one credential, while the current mapping resolves distinct Cloud and Data Center values and routes each to its matching status endpoint.
• The router and source-control conformance suites were run and all tests passed (43 router tests and 55 source-control conformance tests).

_{Ran code and verified through T-Rex}

_{Reviews (6): Last reviewed commit: "fix(lockfile): restore missing apps/dash..." | Re-trigger Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​agent-zero/​source-control@​0.3.0	N/A	N/A	N/A	N/A	N/A

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report