#703 fix(cloud): distinguish GitLab webhook readiness

Outcome

• Preserve structured Cloud refusal codes and exact server remedies for deploy and schedule commands.
• Append interactive-login advice only for legacy typed session_required, not every HTTP 403.
• Keep current insufficient_scope guidance intact, including flows:listeners:write; scoped deployment tokens are supported.
• Keep workspace and flow_repository_not_allowlisted refusals intact without generic login or OAuth hints.
• Keep helper authority intact when the same provider also has an authored event handler.
• Require verified webhook ingress only for providers the command is activating as hosted listener sources. flows run --cloud and flows schedule remain direct/polling submissions even when the authored flow contains GitLab handlers.
• Recheck that explicit ingress result after an interactive browser connection becomes sync-ready; a newly connected GitLab listener cannot bypass the same admission gate.
• Keep f.gitlab, polling, and older Cloud responses compatible; no OAuth switch or replacement connection is attempted.

This is the CLI/SDK half of the GitLab token project-selection repair. It does not mutate a customer connection and is not a deployment.

Verification

The complete affected suite includes regressions proving:

• listener create and active-listener version update refuse eventIngressReady: false;
• an interactive connection is rechecked before listener admission;
• real flows run --cloud and flows schedule paths with an authored GitLab handler proceed to submission without webhook ingress; and
• helper/source requirement collection and older Cloud compatibility remain intact.
• schedule-list 403s retain their structured refusal, so login guidance remains limited to typed session_required responses.

$ ./node_modules/.bin/vitest run tests/cloud-connect.test.ts tests/cloud-deploy.test.ts tests/cloud-schedule.test.ts tests/flow-requirements.test.ts --reporter=dot

 RUN  v2.1.9 /home/khaliqgant/Projects/AgentWorkforce/flows-worktrees/gitlab-token-project-selection/packages/sdk

 ✓ tests/flow-requirements.test.ts (14 tests) 619ms
   ✓ flows check prints REQUIRES > names the helper, the harness and the mcp server of an authored flow 496ms
 ✓ tests/cloud-deploy.test.ts (122 tests) 1044ms
 ✓ tests/cloud-connect.test.ts (36 tests) 2606ms
   ✓ hosted verbs connect before they submit > flows run --cloud submits once the prompt connected the integration 2044ms
 ✓ tests/cloud-schedule.test.ts (22 tests) 3819ms
   ✓ schedule lowering > marks a non-grid cron as Cloud-only rather than approximating it, with a silence budget from its own cadence 1906ms
   ✓ flows check prints declared schedules > shows the lowering for a fixed interval and the Cloud-only note for a real cron 1646ms

 Test Files  4 passed (4)
      Tests  194 passed (194)
   Start at  17:21:30
   Duration  6.00s (transform 1.47s, setup 103ms, collect 7.53s, tests 8.09s, environment 1ms, prepare 219ms)

$ npm run typecheck

> @relayflows/sdk@2.0.63 typecheck
> tsc --noEmit && tsc -p tsconfig.type-tests.json

$ npm run typecheck:tests

> @relayflows/sdk@2.0.63 typecheck:tests
> tsc -p tsconfig.tests.json

$ git diff --check

Captured local outputs: /tmp/flows703-review-fixes-suite.txt, /tmp/flows703-review-fixes-typecheck.txt, and /tmp/flows703-review-fixes-test-typecheck.txt.