feat: adopt the multi-provider pull requests page (DEF-1, DEF-2)

[rynfar]

Brings in the deferred pull-requests surface: a multi-provider PR page with in-app reviews across GitHub, GitLab, Bitbucket, and Azure DevOps, plus the diff-comment review surface.

Upstream	What
cad2c9361 / #4849	Multi-provider pull requests page with in-app reviews (143 files)
a7b0366cb / #6049	PR page header accounts for Windows window controls
f5fce7416 / #6061	Self-hosted GitLab remote routing (was DEF-2)

This adopts ahead of the recorded revisit gates, at the developer's explicit request. The gates had not come due — the date gate was 2026-08-25 and the churn check is still non-empty. That is a deliberate override, not a passed gate, so expect the surface to keep moving upstream and to need follow-ups.

Conflict resolutions, all Pylon-first

Only three conflicts across 143 files:

• index.css — upstream reintroduces --animate-status-pulse next to a new --animate-ghost-pulse. Only ghost-pulse was taken. The new PullRequestGhosts.tsx needs it in six places, while animate-status-pulse is the continuously repainting dot Pylon deliberately replaced with DotMatrix — and ServerUpdateAction.test.tsx asserts its absence (that test passes here). Pylon's -1s skeleton delay kept over upstream's undelayed one.
• SidebarChrome.tsx — kept Pylon's usage Back button and added upstream's gated Pull Requests entry. This also completes #6031: its usage half landed earlier as K9, but the pull-requests half was left out because Pylon had no such page. That page now has its way back out too.
• RightPanelTabs.tsx — kept Pylon's "Pylon desktop app" wording, took upstream's new terminal disabled-reason key.

Cheaper than expected

No lockfile change, no new external dependency, no vite.config.ts change, no migrations. The only manifest edit is a ./state/pull-requests subpath export in packages/client-runtime/package.json. The generated routeTree.gen.ts carries the new route.

Verification

• Server pullRequest + sourceControl, contracts pullRequest, client-runtime pullRequestDiffHttp: 496 tests pass
• Web pullRequest, diffs, openPullRequestLink, rightPanelStore, reviewCommentContext, useLiveRefresh, ServerUpdateAction: 198 tests pass
• Contracts, client-runtime, web, mobile, server typecheck with no errors
• Lint and format clean across all 145 changed files

Not verified: none of this was exercised in a real client. It adds an entire product surface across web, desktop, and mobile, and its remote and multi-environment behavior is untested in Pylon. Worth a real pass before relying on it.

Merge order

This touches .agents/upstream-review.md and apps/web/src/index.css, both of which #3 also touches. Whichever merges second needs a rebase.

Model: Claude Opus 5 (1M context). Harness: Claude Code.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	11.3 KiB	11.3 KiB	−5 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	5.5 KiB	5.5 KiB	+10 B (+0.2%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	5.9 KiB	5.9 KiB	−15 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	49.7 KiB	49.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	11.3 KiB	11.3 KiB	+8 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	5.5 KiB	5.5 KiB	+14 B (+0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	5.8 KiB	5.8 KiB	−6 B (−0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	50.6 KiB	50.6 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 2faf7c4 · PR result: c7406e0 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 94.6 KiB
• Claude decoded thread snapshot: 95.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.