Fix race condition in code owner approval rules sync on MR creation

What does this MR do and why?

Fixes a race condition where code owner approval rules are not created when an MR is created with merge conflicts.

Root Cause

When an MR is created, two independent Sidekiq workers are enqueued via run_after_commit:

1. SyncCodeOwnerApprovalRulesWorker — syncs CODEOWNERS approval rules
2. NewMergeRequestWorker — creates the merge_request_diff (via AfterCreateService)

The merge_request_diff is deliberately not created during the MR save (skip_ensure_merge_request_diff = true). It is only created later when NewMergeRequestWorker runs. If SyncCodeOwnerApprovalRulesWorker runs first, it finds an empty diff, modified_paths returns [], no CODEOWNERS entries match, and no approval rules are created.

For MRs without conflicts, this is masked because the mergeability check later triggers ReloadMergeHeadDiffService which re-syncs the rules. But for MRs with conflicts, this recovery path never fires (merge_to_ref fails), leaving the MR permanently missing code owner approval rules until a new push.

Fix

Move the SyncCodeOwnerApprovalRulesWorker enqueue from CreateService#after_create to AfterCreateService#prepare_merge_request, which runs inside NewMergeRequestWorker after ensure_merge_request_diff has populated the diff. The temporarily_unapprove! TTL is refreshed to account for the additional time.

Feature Flag

sync_code_owner_approval_rules_after_diff_creation — disabled by default.

Verified

• Confirmed on live gitlab.com MR !225983 (closed) (has conflicts): approval_rules API returns empty []
• Confirmed on live gitlab.com MR !225980 (conflicts resolved): returns 3 code owner rules
• Reproduced locally on GDK

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.

EE: true Changelog: fixed