Draft: [local-dev] Test orbit MCP + remote GLQL in Data Analyst agent

What this is

Local-dev only — DO NOT MERGE.

Adds env-var-gated overrides so the Data Analyst agent (analytics_agent/v1) can be tested end-to-end against gitlab.com's orbit MCP server and gitlab.com's GLQL / GraphQL, without running a local Knowledge Graph (GKG) backend.

All patches are no-ops when the relevant env vars are unset.

Patches in this MR

File	Purpose
workhorse/internal/ai_assist/duoworkflow/mcp.go	Redirects orbit MCP HTTP calls to https://gitlab.com/api/v4/orbit/mcp when ORBIT_PAT is set.
app/services/analytics/glql/query_service.rb	Routes server-side GLQL execution to gitlab.com's /api/graphql when GITLAB_TOKEN is set.
app/assets/javascripts/glql/core/executor.js	Routes browser-side GLQL queries to gitlab.com when VITE_REMOTE_GLQL_PAT is set at vite build time.
config/initializers/content_security_policy.rb	Adds https://gitlab.com to connect-src.
LOCAL_DEV_ORBIT_TESTING.md	Full setup + verification + troubleshooting. Read this first.
refresh-orbit-token.sh	One-command helper to refresh the orbit MCP OAuth token and sync env.runit.

How to test

See LOCAL_DEV_ORBIT_TESTING.md in the branch — it covers tokens, env.runit, feature flags, the namespace setting, and the gateway-side YAML change.

To refresh the MCP token

The orbit MCP token has a ~2h TTL. Use the bundled helper:

./refresh-orbit-token.sh           # no-op if token still has >10 min of life; otherwise refreshes
./refresh-orbit-token.sh --force   # force the OAuth refresh round-trip
./refresh-orbit-token.sh --help    # flags + behaviour

What it does:

• Kills stale mcp-remote process trees (broader pattern than the npm exec / node wrapper).
• Drives npx -y mcp-remote to refresh via the cached refresh_token, then polls for the token file's mtime to advance instead of blind-sleeping — the brittle sleep 6 race in the original snippet is gone.
• Rewrites ORBIT_PAT in ~/Developer/gdk/env.runit and verifies the rewrite matches the new access_token.
• Restarts gitlab-workhorse (skippable with --no-restart).

What's not in this MR

• The gateway-side YAML change for analytics_agent (toolset additions) — that lives in gitlab-ai-gateway, apply it locally per the doc.
• env.runit — local to each developer.