Add a shared-group approval rule to protected project environments #652

Problem

Protected project environments can display approval rules and edit their counts,
but cannot add an approver group from LabFox.

Scope

Add one group-based approval rule to an existing project protected environment.
Accept an exact positive shared group ID and 1–5 required approvals, with direct
membership only (group_inheritance_type: 0). Require exact environment-name
confirmation and acknowledgement. Complete paginated inventory and strict detail
preflight must preserve all existing deploy/approval rules and legacy approval
count; reject duplicate group rules. No group discovery, group-level writes,
user/role grants, or inherited-membership selector in this slice.

Send one PUT containing only the new approval rule without ID, redirect following,
or automatic OAuth replay. Confirm the returned rule and fresh complete detail,
including a new unique record ID, exact group/count/membership and unchanged
existing fields. Session changes and uncertain results require inspection and
fresh confirmation, with no automatic retry.

Validation

Test first: transport/body, malformed/status-first responses, pagination,
preservation, duplicate/stale/uncertain/session cases, five locales and responsive
light/dark UI. Run formatting, analysis and all package/app tests; add synthetic
screenshots and MW-02 evidence. Live role/tier/version validation remains open.

GitLab reference

https://docs.gitlab.com/api/protected_environments/#update-a-protected-environment
https://docs.gitlab.com/api/protected_environments/#example-create-an-approval_rule-record

Premium/Ultimate, project CI/CD enabled, appropriate management permissions and a
group with which the project is shared are server requirements. The endpoint
does not provide atomic compare-and-set.