feat(orbit-cli): add GitLab-aware grep and context, refresh on read, and one Orbit skill

What does this MR do and why?

Agents working in an indexed checkout get the GitLab context of a change without leaving Orbit. A plain orbit grep also searches the GitLab group behind the origin remote, and orbit context reads merge requests, issues, branches, pipelines, and job logs, with the local code they point at. Edited files refresh into the graph when either command reads them, so answers follow the working tree.

In SDLC evals, agents with Orbit took 23% fewer turns than the baseline at the same reward.

Query engine changes

This MR also changes the GQL frontend, so it needs a query engine review:

• RETURN accepts count(DISTINCT x).
• CALL db.schema() lists each relationship as (Source)-[:TYPE]->(Target|Target) and the properties of the core, code_review, and plan nodes. CALL db.schema('Node') lists properties as name:type with enum values and no descriptions. The MCP schema tool keeps the full descriptions.
• In the raw format, the overview lists a node without properties as a bare name and a core node as an object whose props is one comma-separated string. The single-node call returns props as an array. Uniform objects would add about 240 bytes to every llm overview, so the mixed shape stays.

Setup no longer writes the schema into the instruction block, where every session paid for it on every turn. A schema error in orbit query appends the CALL db.schema() output. In the v1-release evals, graph agents answered 95.2% correctly against 60.2% without Orbit, at the same tokens per correct answer (-3%, 95% range -20% to +12%). Coding agents used 9% fewer tokens per quality point (range -17% to -1%).

Related Issues

Needs gitlab-org/gitlab!265236 (merged) deployed on GitLab.com: typed grep scopes and branch, pipeline, and commit context use it.

Builds on the incremental indexing from !2994 (merged), now merged. Uses GitLab's grep and context endpoints, gitlab-org/gitlab!256404 (merged), gitlab-org/gitlab!262223 (merged), and gitlab-org/gitlab!264100 (merged) for job context.

Testing

remote_cli tests cover the GitLab grep request, a branch context target, and the refresh after an edit, compared against a fresh index. Checked by hand with the built binary: YAML keys such as project: [ search as text, file context lists callers and test files, a bad target in a batch is reported and the rest render, and an edit is found by the next grep.

Performance Analysis

• This merge request does not introduce any performance regression. If a performance regression is expected, explain why.

A refresh waits up to two seconds and finishes detached after that, so a slow refresh never blocks a read. GitLab search asks only for work items, merge requests, and notes, with at most 5 searches per command, so a grep never fans code or commit search out to Gitaly across the group.

Agent context: long-form analysis, file-by-file walkthroughs, profiler output, alternatives considered

Refresh on read

• index/incremental: refresh runs a detached orbit refresh and waits up to ORBIT_REFRESH_WAIT_MS, default 2 s. One refresh runs at a time behind a file lock, and at most one waits. A killed refresh leaves no stale marker.
• output::replacement and GraphWriter::delete_files replace the rows of the changed files only.

GitLab from grep

• remote/grep.rs: one request per | alternative to /api/v4/orbit/grep, at most 5, scoped to the top-level group of origin. Default scopes are work items, merge requests, and comments; commit:, user:, project:, group:, and milestone: ask for the others. Code search is left out, since basic search runs it on Gitaly for every project in the group.
• A clear title winner is inlined with its context once per 30 minutes. Terms under 2 bytes skip GitLab, and the request timeout is 10 s.

GitLab from context

• remote/sdlc.rs: branch:, pipeline:, job:, commit:, and a bare orbit context on the current branch. Job logs are trimmed to failure lines and file diagnostics.
• remote/context.rs: posts tokens to /api/v4/orbit/context and trims the graph section and repeated failed jobs.
• commands/anchors.rs finds the files, lines, and names GitLab text mentions and appends that code from the local graph.

Local context and grep

• A whole-file target prints its source like a line range, with a line naming the indexed callers of its definitions and the test files for it.
• A batch renders the targets that resolve and names the missing ones.
• A bare kind: inside a query is text, so YAML keys do not start GitLab searches. A --led argument that is no flag is read as the pattern.
• Sibling directories holding the same lone file share one line in the grep index.

Skill

• One Orbit skill covers grep, context, GitLab context, and graph queries. Its description is what agents see when they choose a skill, and it named only graph questions, so no SDLC eval trial loaded it.
• A skill composed for the standalone orbit binary says to run each glab orbit <command> with that binary.

Setup: setup mentions GitLab in the agent instructions only when Orbit answers for origin.

Related to https://gitlab.com/gitlab-org/orbit/knowledge-graph/-/work_items/1260