Replace the group on a protected environment approval rule #656

Problem

LabFox can add or remove a group approval rule, but cannot replace the approver
group on an existing project protected-environment rule while keeping its ID,
approval count and membership setting.

Scope

Select one existing group-only approval rule with positive stable rule/group IDs,
a positive required approval count and explicit direct/inherited membership.
Enter a different positive shared group ID; block any group already present in
another approval rule. Require exact environment name and acknowledgement.
Group-level rules, user/role conversion and group discovery remain out of scope.

Complete paginated inventory and strict detail preflight must match the frozen
snapshot. Send one non-replayed/non-redirected PUT containing only the record ID
and new group ID. Preserve stable identity, approval count, membership, every
other approval/deploy record and legacy count. The selected group's server
description may change with its identity; response and authoritative read-back
must agree on the entire new snapshot. Unknown membership stays read-only.

Uncertainty requires inspection and new confirmation. Account replacement and
overlap cannot dispatch or refresh the wrong account. No atomic compare-and-set
guarantee or live eligibility inference is claimed.

Validation

Test first: encoded exact body, malformed/status failures, no OAuth replay,
pagination, unchanged/unknown/duplicate/stale targets, preservation with updated
description, uncertainty/session isolation and five-locale responsive themes.
Run all local quality gates; add fixture screenshots and MW-02 evidence.

GitLab reference

https://docs.gitlab.com/api/protected_environments/#update-a-protected-environment
https://docs.gitlab.com/api/protected_environments/#example-update-an-approval_rule-record

Premium/Ultimate, CI/CD enabled, management permissions and project sharing with
the new group are server requirements. Live role/tier/version checks remain open.