feat: folder-scoped review instructions for the deployment ai review (#12037)

* feat: add ai review to deployment requests

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: bound ai review fetches and surface unreadable items

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: add fix in ai session and model picker to deployment ai review

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: add workspace instructions for deployment ai review

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: read review instructions from the parent and bind ai review to the fork

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: pin the fix-all session preview to the fork's compare page

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: show the protection-rule bypass toggle inline

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: make the bypass toggle small and red

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor: drop workspace-settings instructions from deployment ai review

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: folder-scoped review instructions for the deployment ai review

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: review the selected items with ai on compare and deploy

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: keep reviewing when review instructions cannot be listed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: say the review instruction floor is a prompt request, not enforcement

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: mark an ai review out of date when its items change

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: update ee-repo-ref to 77703cf32e58964906d87ee83ddda44b5b8d1b7e

This commit updates the EE repository reference after PR #926 was merged in windmill-ee-private.

Previous ee-repo-ref: e30ab9e69d1854fcaed5620c934ace32acb0a729

New ee-repo-ref: 77703cf32e58964906d87ee83ddda44b5b8d1b7e

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

backend/migrations/20261028002118_ai_review_instruction_resource_type.down.sql

@@ -0,0 +1,6 @@
+-- `created_by` tells this migration's row from one a user created by hand; a hub
+-- sync updates in place and leaves it alone.
+DELETE FROM resource_type
+WHERE workspace_id = 'admins'
+  AND name = 'ai_review_instruction'
+  AND created_by = 'system';

backend/migrations/20261028002118_ai_review_instruction_resource_type.up.sql

@@ -0,0 +1,15 @@
+-- Review instructions for the AI review of fork deployment requests: a markdown
+-- file resource whose `value.content` applies to every changed item under the
+-- directory it lives in. Read from the parent workspace, the one the changes merge into.
+-- Seeded under 'admins' so every workspace sees it before the next hub sync.
+INSERT INTO resource_type (workspace_id, name, schema, description, created_by, format_extension, edited_at)
+VALUES (
+    'admins',
+    'ai_review_instruction',
+    '{"type": "object", "properties": {"content": {"type": "string"}}}',
+    'Instructions for the AI review of deployment requests that apply to every changed item under the folder this resource lives in: an ai_review_instruction at f/billing/REVIEW is given to the reviewer whenever a fork''s changes touch something under f/billing/. It is read from the workspace the changes are merged into. The file body is the instructions the review follows.',
+    'system',
+    'md',
+    now()
+)
+ON CONFLICT (workspace_id, name) DO NOTHING;