Gate resolve-dependency-bump button to dependency bot MRs

What does this MR do and why?

The "Resolve breaking changes with Duo" button previously appeared on every MR with a failed pipeline whenever the project setting and feature flag (enable_dependency_bump_breaking_changes) were enabled. This restricts it to MRs actually opened by the dependency management bot.

It adds an MR-scoped availability check on MergeRequestType (duoDependencyBumpBreakingChangesAvailable) that combines the existing project-level availability with a new MergeRequest#dependency_management_mr? predicate, which verifies both the dependency-management branch prefix and a service-account author matching DependencyManagement::ProvisionServiceAccountService::SERVICE_ACCOUNT_NAME. The button widget now queries the MR instead of the project.

The predicate is shared with the dependency management event subscriptions (DependencyManagementSubscriptions#dependency_management_mr?) so the "is this a dependency-bump MR" definition lives in a single place.

Note: this also declares the previously-undeclared iid prop on mr_widget_pipeline.vue (it was passed by the container but never declared), which the new query needs.

References

• Button introduced in !243095 (merged)

Screenshots or screen recordings

How to set up and validate locally

1. Import the test project

Import this corpus project (its CI fails by design, which the button requires): https://gitlab.com/compliance-group-testing-and-demos/team-testing-subgroup/hraghuvanshi/dep-bump-security-corpus/oauth2-faraday2-sec

2. Enable the prerequisites

1. Enable Resolve Dependency Bump Breaking Changes in the top level namespace GitLab Duo configuration.
2. Under the project settings Turn on Agentic Breaking Change Resolution is enabled.

3. Create the MR (UI) and reassign its author to the bot (Rails console)

1. In the UI, create an MR similar to https://gitlab.com/compliance-group-testing-and-demos/team-testing-subgroup/hraghuvanshi/dep-bump-security-corpus/oauth2-faraday2-sec/-/merge_requests/1 with a source branch prefixed dependency-management (e.g. dependency-management-bump-faraday) that bumps faraday, targeting the default branch. Let its pipeline run and fail.
2. Reassign the author to the dependency-management service account:

project = Project.find_by_full_path('<your-namespace>/oauth2-faraday2-sec')

# Provision (or reuse) the "GitLab Dependency Management" service account
res  = DependencyManagement::ProvisionServiceAccountService.new(project: project).execute
raise res.message unless res.success?
user = res.payload[:user]

# Reassign the manually-created MR's author to the service account
mr = project.merge_requests.find_by(iid: <MR_IID>)
mr.update!(author: user)

puts "MR !#{mr.iid} author=#{mr.author.name} bot_mr?=#{mr.dependency_management_mr?} available?=#{mr.duo_dependency_bump_breaking_changes_available?}"
# => author="GitLab Dependency Management" bot_mr?=true available?=true

4. ✅ Positive case — button IS shown

Reload the bot MR from step 3. With its pipeline failed, the "Resolve breaking changes with Duo" button appears on the pipeline widget.

5. ❌ Negative case — button is NOT shown (the regression this MR fixes)

Open a normal MR same as https://gitlab.com/compliance-group-testing-and-demos/team-testing-subgroup/hraghuvanshi/dep-bump-security-corpus/oauth2-faraday2-sec/-/merge_requests/1, authored by your own user — and let its pipeline fail. The button does not appear.

Sanity check (console): merge_request.duo_dependency_bump_breaking_changes_available? is false for the normal MR and true for the bot MR.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.