feat(runway): wire the git merger into the server

[behinddwalls]

Summary

Why?

The git merger exists but nothing constructs it — the server still builds the noop factory, so a deployed Runway acknowledges every merge as an instant success. This is the change that makes Runway actually merge.

It is deliberately last in the stack and deliberately opt-in: the switch is the presence of MERGE_CHECKOUT_PATH. Unset, the server keeps wiring noop, which is what local development, the compose stack, and the e2e suite depend on — none of them have a git checkout to hand the merger.

What?

newMergerFactory now reads the environment and returns either backend. With MERGE_CHECKOUT_PATH set it builds a git merger from the MERGE_* / GIT_* variables — remote, target branch, default strategy, committer identity, and the pinned git runtime — and logs the resolved configuration at startup. Without it, noop, with a log line saying so. A malformed configuration fails startup rather than degrading silently: parseStrategy rejects an unrecognized MERGE_DEFAULT_STRATEGY, and DEFAULT itself is rejected because it cannot be the value a DEFAULT step resolves to.

Three settings govern the behaviors the merger cannot infer:

• MERGE_CHECK_STALENESS (default on) verifies each change's provider ref still points at the commit its URI names before applying.
• MERGE_ALLOW_UNRELATED_HISTORIES (default off) lets a MERGE step import a history that shares no ancestry with the target. It stays off because the refusal it lifts is a safeguard everywhere except a queue whose purpose is such imports.
• MERGE_FETCH_REFSPECS supplies extra refspecs for a remote that will not serve an unadvertised commit by SHA. Normally empty.

gitMergerFactory hands the same merger instance to every queue. The merger owns one checkout and serializes its own operations, so a second instance over the same directory would race; a deployment that lands multiple targets wires a per-queue map instead. This is also why the factory is built once at startup rather than per request.

Test Plan

✅ bazel build //service/runway/... — wiring compiles
✅ bazel test //runway/... — all targets pass

Not covered by automated tests: the git path only engages when MERGE_CHECKOUT_PATH points at a real checkout, so the env-to-Params mapping is exercised by the merger's own suite rather than through main. Watch the git merger configured startup log — with checkout, target, and default strategy — on the first deployment that sets the variable; its absence means the server silently fell back to noop.

Stack

1. feat(runway): dlq reconciler for merge topics #459
2. feat(runway): git-backed merger with REBASE #460
3. feat(runway): git merger SQUASH_REBASE and MERGE #461
4. feat(runway): git merger PROMOTE #462
5. @ feat(runway): wire the git merger into the server #463
6. feat(runway): reject changes that disagree on provider #476
7. docs: define the URI as the unit of change #477