Ingest GitLab deployments into Production QA

## Gap Epic 12247 item 1 asked for deploy ingestion "on the existing `github` trigger source (and each supported forge's equivalent)". Only GitHub shipped (architecture AC-6 deferred GitLab, Bitbucket and Azure DevOps to Finish). Observed: `apps/api/app/triggers.py:16-45` has no GitLab source kind; `HTTP_SOURCE_KINDS = (webhook, github) + monitors`; `apps/api/app/production_qa/deployments.py` reads GitHub `push`/`workflow_run`/`workflow_job`/`deployment_status` only. A GitLab-hosted project gets no Deployments rows, no `deployed` ledger edge and no `deploy_failed` incident. ## Fix Add a record-only `gitlab` deploy recorder that maps GitLab webhook events (Pipeline Hook, Job Hook, Deployment Hook; `X-Gitlab-Token` shared secret, constant-time compare; self-managed base URL from the project's GitLab connection — confirm the event shapes from GitLab's webhook docs, never memory) onto the same `deployments` rows, range/PR mapping, `deployed` edges and `deploy_failed` incidents the GitHub path writes (`deployments.py` `reconcile`). Reuse the GitHub path's classification and Connect deploys UI (Project › Production QA) with a GitLab variant; no new table, reuse the existing CHECK widening pattern if a source kind is needed. ## Acceptance - A GitLab Deployment Hook success for the production environment creates one Deployments row with status success, its commit range and the merged MRs' tasks — fixture test with GitLab's documented sample payloads. - A failed pipeline job on the production deploy writes one `deploy_failed` incident fingerprinted like GitHub's; a second failure of the same job updates it — test. - Wrong/missing `X-Gitlab-Token` → 401, nothing written — test. - Gate OFF: rows still written, nothing filed — test. - Connect deploys offers GitLab for a GitLab project; checked at 448 px and desktop. Out of scope: Bitbucket and Azure DevOps (own tasks); changing the GitHub path; filing logic (automations already do it); any scoring. Done means: - The four tests above green; UI screenshots in the PR. - Required checks: ./dc check quick, changed-area tests, merge lane full gate.

GitLab deploys now feed Production QA (record-only gitlab trigger, X-Gitlab-Token; Push/Pipeline/Job/Deployment Hooks onto the GitHub recorder; Connect deploys GitLab variant, visual check done at 448px+desktop). Quick gate + tests green; review lanes passed. PR #7658 queued. Memory: none applied.