feat(merge_requests): guard original commit private saves

[sjungwon03]

Summary

An original-commit review selection can now enter the shared discussion write reservation. Fresh original context must match the complete literal-file selection and fresh private MR detail; the captured client verifies the fixed parent in the target project before one unpublished commit draft POST. Account/provider/reload cancellation rejects obsolete outcomes, including reloads of an already-loading snapshot. Uncertain dispatched writes require settled, complete read-only inspection before another save.

Closes #640

Validation

• dart format .: 974 files, zero changes on the final pass.
• flutter analyze: no issues.
• All five package suites: 7,949 tests (app 4,471; design 127; API 3,142; models 204; storage 5).
• TDD: 25 original contracts fail against the stub; three additional origin-consistency regressions fail before the fix. All 35 final tests pass, including real-client read-to-write traversal, multiline selection, shared reservations, cancellation and uncertain-write inspection.
• No model/dependency changes; code generation and license updates do not apply.
• Controller-only change; original-commit review UI, responsive/theme validation and live-instance validation remain subsequent work.

Checklist

• Targets dev; issue linked; Conventional Commit and DCO sign-off.
• English source and updated behavior/parity documentation.
• No public fallback, automatic replay, publication, persistence or analytics emission.

Notes for reviewers

Only a single explicitly reported canonical parent is selectable. Original references and literal selection validation reuse the previous foundation; unknown/root/multiple-parent commits remain unselectable. Sequential preflight reads are not an atomic server snapshot or a live GitLab version guarantee. Already-dispatched server writes cannot be cancelled; recovery waits for the actual request to settle before traversing all advertised private-note pages.

[sjungwon03-ai]

Reviewed commit d5b5e34: The five remote PR blobs match the reviewed local commit. Original selections enter the existing shared discussion write/pagination reservation. Fresh complete literal-file fingerprints, MR global/IID/target/source/branch consistency and a captured-client fixed-parent availability read precede exactly one unpublished commit draft write. Original snapshot session-end observation also cancels already-loading reloads. Account/client/repository/snapshot guards reject obsolete reads and outcomes; strict acknowledgements preserve author/global MR/exact Markdown/commit/position/private metadata. Uncertain dispatched writes block replay and use existing settled all-page read-only inspection. Format/analyze and all 7,949 local tests pass, including 35 new cases and real-adapter traversal. No blocking findings. Original review UI and live-instance validation remain separate; sequential reads are not atomic server authorization.