GitLab Issue to MR Automation

Create a cron automation that watches one or more GitLab projects for issues with a trigger label, starts an OpenHands conversation once per label event with the project's default branch already checked out, and opens a merge request with whatever the agent produced.

The automation script is deterministic: issue discovery, label-event tracking, state persistence, the clone, the branch, the commit, the push, the merge request, the issue comments, and the clone's removal are all handled in Python. The LLM is invoked only to write the code.

The agent is told which issue to implement, not what it says. It fetches the description, the discussion, and whatever they link to itself, so nothing in the prompt goes stale between dispatch and the moment the agent reads it.

That needs read access, so the conversation is handed one secret, GITLAB_TOKEN. AGENT_SECRET_NAMES stays an allow-list: the rest of the deployment's secret store is not reachable from a conversation whose instructions came from an issue.