Phase 5: Integration tests, edge cases, linting, final polish - #6

…, dedup

Thermo-nuclear review follow-ups (behavior-preserving):
- #1/#6: move inline nfpm loop -> build/package/linux/build_packages.sh and the
  zip+sha256 -> build/package/zip_binary.sh (explicit per-OS archiver); workflow
  is now pure orchestration.
- #2: .github/actions/setup-build composite (uv + optional Node) replaces the
  repeated setup preamble in pypi/freeze.
- #3: index.sh deb/rpm/apk collapsed into a publish_repo() helper + per-format indexers.
- #5: sign.sh parses the Azure token with jq instead of a sed regex.
- #7: nfpm.yaml notes it's rendered via envsubst.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…, dedup

Thermo-nuclear review follow-ups (behavior-preserving):
- #1/#6: move inline nfpm loop -> build/package/linux/build_packages.sh and the
  zip+sha256 -> build/package/zip_binary.sh (explicit per-OS archiver); workflow
  is now pure orchestration.
- #2: .github/actions/setup-build composite (uv + optional Node) replaces the
  repeated setup preamble in pypi/freeze.
- #3: index.sh deb/rpm/apk collapsed into a publish_repo() helper + per-format indexers.
- #5: sign.sh parses the Azure token with jq instead of a sed regex.
- #7: nfpm.yaml notes it's rendered via envsubst.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The big one (#2, upgraded): the diff sides' wire shape was WRONG in the
implementation and in the test fixtures that defined it. Verified against
connection (ConfigurationVersionResponse + ConfigurationDiffData OA
schemas, now recorded in the notes wire-truth table): each side is
{version, isDeleted, diff: {name, description, changeDescription,
isDisabled, configuration, rows}} -- content NESTED under diff,
version/deletion as side metadata. The classification and both take modes
now read the envelope; the flat-side code would have been dead on arrival
against the live API.

#1: resolve_conflict no longer takes branch_id -- it derives the branch
from the MR itself (branches.branchFromId), so the conflict-set guard and
the branch being written to can never disagree; a caller-supplied id could
point the REPLACing rebase at an unrelated dev branch the guard never
checked. A published/canceled MR (null branchFromId) is refused readably.

#3: take=theirs of a deleted side collapses to the delete resolution,
symmetric with ours ('production deleted it, dev changed it' is a live
conflict shape).
#4: deletion surfaces as top-level ours_deleted/theirs_deleted booleans on
get_config_diff (None = side never existed) -- it is side metadata, not a
content path.
#5: a 'both' row where the sides agree on the identical value carries
agreed: true -- agreement, not a conflict hotspot.
#2 (message half): a take side missing required envelope keys is reported
as a backend contract violation pointing at the resolved-body workaround,
not as caller error.
#6: wire ids compared via _same_id / int-coerced (find_merge_request_for_
branch, merge()'s was_active) -- a string-serialized branchFromId can no
longer silently defeat the post-merge cleanup.
#7: the feature pre-flight raises FeatureNotEnabledError carrying the new
ErrorCode.FEATURE_NOT_ENABLED (value matches the string SearchService
already emits; categorized 'configuration' like PAYG_NOT_AVAILABLE).
#8: ConfigError imported from ..errors like every other service; the
isDefault scan hoisted to services.base.find_default_branch_id and the
copies in config/sync/workspace services migrated (lib.py keeps its own
loop -- the SDK facade does not import the services layer); verify_token
is skipped when the server already serialized viewer (the polyfill's cost
dies with the polyfill); list --state validates against the closed
vocabulary instead of returning a silent count: 0 on a typo.
#9: test imports hoisted (no mid-file noqa), mocks spec'd at the L3 seam
(KeboolaClient + MergeRequests -- a renamed L3 method now fails the tests),
and regression tests added for every finding (82 tests total).

Doc drift: layer2/layer3 references updated to BRANCHES_MERGE_REQUESTS_
FEATURE, the layer3 open nit closed, tokens.py line ref fixed.

Review: tasks/pr-703-review.md (2026-08-27).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>