refactor: thread instanceUrl from request context through entity handler call sites

[coderabbitai]

Summary

Thread instanceUrl from request context through entity handler call sites to avoid cross-request state leakage in concurrent OAuth traffic.

Context

PR #396 added an optional instanceUrl parameter to WidgetAvailability.validateWidgetParams, WidgetAvailability.isWidgetAvailable, WidgetAvailability.getAvailableWidgets, and related ToolAvailability / RegistryManager APIs. The JSDoc on validateWidgetParams (lines 161–164) documents that request-context callers should pass the per-request URL to avoid reading the wrong tier/version under concurrent OAuth traffic.

However, the call sites inside entity handlers were not updated in PR #396 because they involve a broader handler argument-passing change across all entities.

Work needed

• Update src/entities/workitems/registry.ts: thread instanceUrl (obtained from getGitLabApiUrlFromContext()) into WidgetAvailability.validateWidgetParams(widgetParams, instanceUrl).
• Audit other entity handler call sites that invoke ConnectionManager.getClient() or getInstanceInfo() without an explicit instanceUrl and thread the request-scoped URL through.
• Verify no remaining callers fall back to ConnectionManager.currentInstanceUrl implicitly.

References

• PR refactor: thread instanceUrl and key caches by URL #396 (adds the parameter): refactor: thread instanceUrl and key caches by URL #396
• Review comment: refactor: thread instanceUrl and key caches by URL #396 (comment)

Requested by

@polaz