Draft: Add artifact registry hosted repository create mutation

What does this MR do and why?

Adds the hosted repository create mutation for Artifact Registry (monolith/S07 Step 2), on top of the S07 GraphQL foundation (!248967 (merged)).

Mutations::ArtifactRegistry::Repositories::Create takes name, format, kind, visibility, and description; calls the S02 client create_repository; and returns the created ArtifactRegistryRepository plus the standard errors. All experiment (19.3), behind the dark artifact_registry_ui flag.

The input accepts kind unrestricted while Phase 1 serves hosted only: rather than narrowing the input now and re-widening it in the remote follow-up, Phase 1 relies on Artifact Registry's documented rejection of non-hosted kinds, which surfaces in the payload errors. A flag-off create raises a top-level ResourceNotAvailable with no client call; an AR 403 renders a top-level ResourceNotAvailable; recoverable validation (duplicate or invalid name) populates the payload errors.

The frontend typedefs (graphql/typedefs.graphql) drop the local @client declaration of Mutation.artifactRegistryRepositoryCreate, which the merged Vue write UI declared while there was no backend. Now that this MR adds the real server mutation, keeping the local declaration would collide during the Apollo schema build. The create flow still runs on the local mock resolver through the remaining @client operation.

References

• Spec: docs/specs/monolith/S07-repository-crud.md (Approved), Mutations
• Plan: docs/plans/monolith/2026-07-17-repository-crud.md (merged), Step 2
• Builds on the S07 foundation: !248967 (merged)
• Shared type and enums: !248690 (merged) (monolith/S04), merged

Screenshots or screen recordings

N/A. Schema only, behind a dark flag.

How to set up and validate locally

1. Point the client at a local Artifact Registry service and enable the flag:

   org = Organizations::Organization.first
   Gitlab.config.artifact_registry['api_url'] = 'http://127.0.0.1:8090'
   Feature.enable(:artifact_registry_ui, org)

2. Issue the create mutation and confirm the created repository is returned with empty errors:

   mutation = <<~GQL
     mutation($name: String!, $format: ArtifactRegistryRepositoryFormat!, $visibility: ArtifactRegistryRepositoryVisibility, $description: String) {
       artifactRegistryRepositoryCreate(input: { name: $name, format: $format, visibility: $visibility, description: $description }) {
         repository { name format kind visibility description settings }
         errors
       }
     }
   GQL
   user = org.organization_users.first.user
   pp GitlabSchema.execute(mutation,
     variables: { 'name' => 'my-repo', 'format' => 'NPM', 'visibility' => 'PRIVATE', 'description' => 'A repo' },
     context: { current_user: user, current_organization: org }).to_h

3. Confirm a duplicate or invalid name populates the payload errors; a kind: REMOTE create passes through and surfaces AR's rejection in the payload errors; and with the flag off the mutation raises a top-level ResourceNotAvailable with no client call.

Request spec:

bundle exec rspec ee/spec/requests/api/graphql/mutations/artifact_registry/repositories/create_spec.rb

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.