feat(source-control): groundwork for self-hosted Bitbucket

[OhadC]

Self-hosted Bitbucket (Data Center / Server) support, proposed in #10837, needs four small things outside its own package. This PR lands only those, so the next two PRs stay inside the new package. It is the bottom of a three-PR stack: repositories in #18241, pull requests in #18242.

Summary

 SourceControlHost git
+  fetchRemoteRef({ remoteName, remoteRef, localBranch })   # Data Center checks out refs/pull-requests/N/from, which is not a branch

 SourceControlClientDefinition
-  publishDescription: string
+  publishDescription: string | null                         # null keeps a host out of the publish picker; every current host keeps its string

 source-control-bitbucket
+  export normalizeBitbucketChangeRequestId, toBitbucketChangeRequest   # moved to bitbucketPullRequests.ts so Data Center reuses them

 desktop backend env
+  NODE_USE_SYSTEM_CA=1                                      # the bundled server trusts the OS certificate store

Desktop users can't set environment for the bundled server, so a host behind an organization's own certificate authority fails TLS there. NODE_USE_SYSTEM_CA adds the OS store to Node's bundled roots; it removes nothing.

Evidence

No UI change: the publish picker lists the same hosts, since no host returns null yet.

• GitVcsDriverCore.test.ts: fetchRemoteRef fetches a non-branch ref into a local branch.
• DesktopBackendConfiguration.test.ts: the backend child env carries NODE_USE_SYSTEM_CA=1.
• Typecheck and knip pass for the touched packages.

Merge Danger

Door: two-way

Blast Radius: desktop TLS

The bundled server now also trusts certificates from the OS store. That widens trust to whatever the machine trusts, which is what a browser on the same machine already does.

🤖 Generated with Claude Code — Claude Opus 5.5 in T3 Code

[juliusmarminge]

Note

This comment is posted by Julius' dot

This prepares a new Data Center integration and changes the desktop's default TLS trust. #10837 still awaits maintainer sign-off on that direction and scope. The prior-approval requirement applies to drafts too, so I'm closing this. Please obtain approval in that discussion and link it when requesting reconsideration.