[Feat] Resolve bare issue references (#234, ENG-512) against configured repositories

[daniel-lxs]

What changed

Stacked on #718 (provider registry) — review and merge that first; this PR's base is its branch, so once #718 lands this can be retargeted to develop and will show only the bare-reference diff.

Closes the last gap in the lookup gate: the routing precheck already extracts references like #234, acme/web#42, or ENG-512 into its externalReference field, but nothing acted on it when the message had no pasted URL — the flag stayed telemetry-only for bare references. Now, when the precheck returns needsExternalLookup=true and URL parsing finds nothing, gatherExternalIssueContext resolves the reference deterministically:

• ENG-512-style identifiers → Linear get_issue directly.
• owner/repo#N → fetched only if that repo is in the deployment's configured repositoryNames (case-insensitive match, configured casing wins).
• Bare #N / N → fans out across configured repositories, but only when there are at most 3 (else fail open); each result is labeled per repo ([acme/web#234]) so the informed re-route call disambiguates.

Bare references normalize to canonical URLs and run through #718's registry, so fetch-attempt construction (incl. GitHub's issue_read → get_issue fallback) stays single-source. Pasted URLs always take precedence over the precheck reference.

Security posture unchanged

The model proposes reference text only; fetch targets come from a closed candidate set (the deployment's own configured repos / the connected Linear workspace), execution stays in server code under the existing shared 8s fail-open deadline. A hallucinated or injection-steered reference can at most read issues the deployment already routes for — the same authority a pasted URL has.

Tests

Five new external-issue-context cases (bare Linear id, multi-repo fan-out with per-repo labels, repo-qualified validation incl. unconfigured-repo rejection, too-many-repos fail-open, URL precedence) plus an end-to-end router-service case (Check issue #234 → fetch → phase: 'mcp'). 13 files / 104 router tests green, pnpm knip clean, tsc --noEmit clean.

🤖 Generated with Claude Code

[roomote-roomote]

No new code issues found. See task

_{Reviewed e89da82}

[daniel-lxs]

Added the fake-timer test for the shared 8s deadline — and it caught a real (pre-existing, since #693) bug: withExternalLookupTimeout received an already-invoked promise, so once the deadline was exhausted the next MCP fetch attempt was still dispatched and merely never awaited. The deadline gated waiting, not dispatching. Fixed in e89da82 by making the helper take a thunk and check the remaining budget before invoking. Net behavior change: a hung first fetch no longer fires a second fire-and-forget MCP call after the budget expires. 105 router tests green.