feat(gitlab): track contributor seat on merge request opened

[tnt-sentry]

Seeds OrganizationContributors when a GitLab merge request is opened, so seat-based Seer billing works once an org is moved onto organizations:seat-based-seer-enabled. Mirrors the GitHub side, where track_contributor_seat fires from the pull_request opened webhook (src/sentry/integrations/github/webhook.py).

Implemented as a WebhookProcessor registered on MergeEventWebhook so errors are isolated per-processor by the existing _handle loop. Action filtered to "open" only — GitLab's merge_request event also delivers update / close / merge actions that should not seed a contributor.

Gating:

• organizations:seer-code-review-gitlab — the same cohort flag handle_merge_request_event uses, so seat seeding only happens for orgs that are already opted in to GitLab code review.
• organizations:seat-based-seer-enabled — checked inside the downstream should_increment_contributor_seat. Required before any row is actually written or a seat is assigned.

This supersedes #116305, which was opened against the pre-#116317 webhook shape and is no longer rebaseable.

Once this lands, the gap documented in src/sentry/seer/code_review/webhooks/merge_request.py's module docstring ("Code review does not fire in production yet: GitLab contributors are never seeded") closes, and the only remaining blocker before billing flips on is the per-org subscription option (SubscriptionOptions.SEER_USER_ENABLED) gating seat-based-seer-enabled.

Refs SCM-99

[linear-code]

SCM-99

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit cde14b9. Configure here.}

[billyvg]

Reviewed this — design and ordering rationale are solid, and the dedup/ordering docstrings are genuinely helpful. Two things worth addressing before merge (filing the other two findings as SCM follow-ups):

1. Module docstring contradicts the actual write behavior

In seat_tracking.py the docstring says:

The downstream call to should_increment_contributor_seat additionally requires organizations:seat-based-seer-enabled before any row is actually written or a seat is assigned.

But track_contributor_seat (contributor_seats.py) calls OrganizationContributors.objects.get_or_create(...) unconditionally, then checks should_increment_contributor_seat. So the contributor row is written for every org in the seer-code-review-gitlab cohort on every MR-open, regardless of seat-based-seer-enabled — only the action-count increment and seat assignment are gated.

This is almost certainly the intended behavior (seeding the row is exactly what makes preflight stop returning ORG_CONTRIBUTOR_NOT_FOUND), but the docstring — and the PR description, which repeats the claim — misstates the side effect. Could we correct it to something like: "the row is always created for cohort orgs; seat-based-seer-enabled gates only the action increment and seat assignment"? Worth a quick confirm that creating contributor rows for cohort orgs not yet on seat-based-seer-enabled is intended.

4. No end-to-end test that a row is actually seeded

All the unit tests mock track_contributor_seat and call the processor directly, which is great for the action/flag/dedup matrix. But the PR's central claim is "the row exists by the time preflight runs," and nothing exercises the real path through MergeEventWebhook.__call__ → _handle → processor with an unmocked track_contributor_seat asserting the OrganizationContributors row gets created (and that preflight no longer denies with ORG_CONTRIBUTOR_NOT_FOUND). One such test would lock in the integration contract — and would have surfaced the discrepancy in #1. The merge_request.py docstring already nudges toward this ("consider a test that omits [manual seeding] to lock in the intended production behavior").

The documented "known gap" (missing last_commit/author email short-circuits __call__ before _handle, so the author is never seeded, and the subsequent update is filtered out by action == "open") is correctly tracked on SCM-99 — fine to defer.

Two more minor findings (alias/external_identifier actor-source mismatch, and the duplicated _is_duplicate_delivery helper) are being filed as SCM follow-ups rather than blocking here.