Add job tokens and task context to the Orbit context endpoint

What does this MR do and why?

POST /api/v4/orbit/context resolves CI/CD job tokens, and its summaries carry what an agent needs for the task at hand:

• Merge request: description, changed files with changed line ranges, merge commit, failed jobs of the head pipeline, and discussions.
• Work item: description and discussions.
• Job: status, stage, failure reason, pipeline, the pipeline's merge request, failed tests, and the end of the log.

Failed tests come from the job's unit test report. The end of the log is the job script output, taken from the log sections Gitlab::Ci::Ansi2json reads; a log without a script section, such as a job that failed pulling its image, returns the tail of the whole log. Expansions use the task-shaped context_for_review, context_for_issue, and context_for_job named queries. The response version moves to 1.2.0.

The Orbit SDLC agent evals already run against an instance with this change.

References

• Named queries: gitlab-org/orbit/knowledge-graph!3001 (merged). Merge that first; until it is deployed, expansions return execution_error.
• Endpoint: !262223 (merged).

How to set up and validate locally

1. Enable Orbit for a group and index it.
2. Request a failed job: curl --request POST --header "PRIVATE-TOKEN: <token>" --header "Content-Type: application/json" --data '{"tokens": ["Job[<id>]"], "response_format": "llm"}' "http://gdk.test:3000/api/v4/orbit/context"
3. The response shows failed_tests when the job has a JUnit report, and the last lines of its script output under log:.

Notes

• Text summaries name entities as path!iid, path#iid, and Job[id], which agents can pass back as tokens.
• Every new list is capped, and a cut list is named in summary.truncated, or, for the failed tests of an MR's failed job, in that job's own truncated.
• On a fine-grained token, each field needs the permission that REST needs for the same data: read_job for a job, including its pipeline status, and for job logs, read_pipeline for the pipeline status and failed jobs of a merge request and for failed tests, download_code for changed files, and the discussion permission of the merge request, issue, or epic for discussions. A test report also needs the report's own artifact access.
• Fine-grained token scopes apply to the summary only. Graph expansion follows the user's own access, the same as named queries, so it can include nodes, such as a pipeline, that the summary leaves out for the token.
• An error while reading a job's test report or log is tracked and leaves those fields out; it never fails the summary.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.