fix: preserve project provider identity

[mariusvniekerk]

Project registration now requires explicit provider identity when linking a platform repo, so GitLab projects cannot be silently recorded through the old GitHub-only host/owner/name compatibility path. The legacy varargs UpsertRepo API was removed and call sites now pass RepoIdentity values.

[mariusvniekerk]

This change is part of the following stack:

• Add embed-targetable workspace surfaces and project/worktree registry #258
  • fix: preserve project provider identity #261 ◀
    • fix: route embed details with explicit provider #262
      • fix: preserve nested repo paths in embeds #263
        • refactor: isolate workspace embed shell #264

_{Change managed by git-spice.}

[roborev-ci]

roborev: Combined Review (59737b1)

No Medium, High, or Critical findings were reported.

All agents that provided review content found the code clean.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (8fac843)

No Medium, High, or Critical findings were reported across the reviews.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (fa0483b)

Medium issue remains: UpsertRepo now bypasses repo identity canonicalization.

Medium

• internal/db/queries.go:523: UpsertRepo no longer canonicalizes RepoIdentity inputs before persisting them. The previous helper normalized typed identities, but the new typed method passes values directly to upsertRepoIdentity, so mixed-case platform/host/owner/name values can create duplicate or unresolvable repo rows.
  • Fix: Canonicalize inside UpsertRepo before calling upsertRepoIdentity, so all insertion paths keep the same normalization guarantees.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)