[POC] Agent session blame in the blob view

What does this MR do and why?

Proof of concept (frontend) for #629586

Adds "agent session blame" to the blob view. Commits made in a GitLab Duo Agent Platform session already carry a Duo-Session: <url> trailer and expose hasAgentSession on the GraphQL Commit type. This MR surfaces that in blame:

• Gutter: agent commits get a plain session-ai icon (neutral, 16px) linking to the session. small round session-ai pill
• Hover popover: hovering or focusing the gutter icon shows the session title (linked, opens the Duo panel), goal, author, time, status (if not finished), and linked MR or issue. Details load the first time the popover opens. A squashed commit with several trailers lists each session.
• Commit popover: gets a "View session" link.
• Nothing renders when blame is off or the commit has no agent session.

Selection popover: with blame on, selecting lines (click, shift-click, #L10-20 link, or dragging over the code) opens a popover listing the sessions that authored those lines, largest coverage first. Each entry shows the session title (linked), the line ranges it covers, the session summary, and author, time, and linked MR or issue. Unresolvable sessions fall back to the trailer link. Replaced by the hover popover, based on UX feedback.

Blame preference to hide agent session annotations. Removed, based on UX feedback.

Session details are looked up by ID with the top-level duoWorkflowWorkflows(workflowId:), the same field the Duo panel uses. Project.duoWorkflowWorkflows only returns remote flows, so sessions from the IDE or chat were missing.

⚠️ Session summary caveat: from what I can tell the backend only writes DuoWorkflow.summary when a session fails (the CI failure reason, or an LLM digest of the failed job log, see #594334 (closed)). Finished sessions have no summary, so the popover shows nothing for them, and when one does appear it describes an error rather than the change. A real "what the session did" summary needs a backend change to set summary on finish. ⚠️ The popover shows the session goal instead, which is always set. Generating a summary when a session finishes is a possible backend follow-up.

TODO

• Address UX feedback from @pedroms
• Decide what to do with the summary field (only set on failed sessions, see Gavin's comment). Using goal instead.
• Put it behind a beta/experiment feature flag
• Add usage tracking (follow-up MR)
• Frontend review
  • Look into !256210 (comment 3946003038) and !258937 (comment 3946074952) (follow-up)
  • Avoid refetching unreadable sessions on every hover (counts toward the duo_workflow_unauthorized_access rate limit), see !256210 (comment 3962686021)
  • Return parsed { id, href } sessions from getAgentSessionUrls so the popover doesn't parse them again, see !256210 (comment 3962685932)
  • Fix "+N more" undercounting when a link type has more than 5 items (first: 5 cap), see !256210 (comment 3962685875)
• Backend check of the switch to duoWorkflowWorkflows(workflowId:)
• Expose duo_session_url on the endpoint (backend follow-up)
• Split the MR if still needed

Screenshots or screen recordings

V1 (stale, selection popover)

How to set up and validate locally

1. Feature.enable(:dap_session_commit_tracking) and enable Duo Agent Platform session tracking in the settings of a project that is in a group, not a personal namespace.
2. Run an agent session against that project so it commits. Confirm the commit has a Duo-Session: trailer.
3. Open a file the session touched with blame on. Check the icon in the gutter and the link in the commit popover.
4. Hover the gutter icon and check the popover shows the session details. Click the title and check it opens the Duo panel.
5. Select lines that include the agent commit and check the popover. Close it, and Confirm nothing renders with blame off or on a file without agent commits.