feat(merge_requests): connect original review snapshots

[sjungwon03]

Summary

Connect captured original MR commit reads to strict immutable review snapshots and resource-bound selection fingerprints. One explicitly reported parent supplies original base/start references and the selected commit supplies head. Unknown/root/multiple parents remain unselectable. Selected rows must belong to the captured literal snapshot; changed MR origin, references, full raw file text or metadata invalidates selection.

An auto-dispose controller captures account/repository currency and changes its session on reload. Obsolete reads/errors are discarded, and current typed failures remain visible. Existing display range behavior remains compatible; literal path hashes are shared and cached per file.

Closes #638

Validation

• dart format .: 973 files, no outstanding changes.
• flutter analyze: no issues.
• All five package suites: 7,914 tests.
• 37 new cases: 27 primary behavior tests fail against stubs before implementation; ten additional lifecycle/identity/real-adapter checks pass.
• Documented primary GitLab source observations and conservative reference limits.
• Generated code, dependencies, UI/layout/themes and localization: unchanged.
• No live GitLab/device validation claimed.

Checklist

• Targets dev, linked issue, Conventional Commit and DCO sign-off.
• Test-first behavior and updated docs/parity tracking.
• English repository prose; dummy adapter credentials only.

Notes for reviewers

Single-parent references implement GitLab's original commit convention; this is not a new REST field or all-version guarantee. Root and multiple-parent commits are intentionally unselectable. Snapshot/selection state does not authorize writes: fresh original references/availability, captured session checks and the shared pending-review write reservation/settled recovery must be connected before exposing private-save UI.

[sjungwon03-ai]

Reviewed commit 981a345: All five remote PR blobs match the reviewed local commit. One captured controller origin routes exact project/IID/global MR/commit identity and checks account/provider/generation currency around every await. Original refs support only a single canonical distinct parent; unknown/root/multiple parents remain unselectable. Strict immutable literal files reject ambiguous paths and fabricated/foreign row selections. Whole-file DTO and MR origin fingerprints reject changes beyond selected text. Multiline positions are canonical and return captured immutable rows; shared cached path hashes preserve display compatibility. Full format/analyze and 7,914 local tests pass, including 37 new cases and real-adapter traversal. No blocking findings. This is read/selection state, not write authorization; shared guarded private-save/recovery UI remains a follow-up.