chore(gitlab): add MR template (ADR-0028 phase 1)

Port .gitea/pull_request_template.md to .gitlab/merge_request_templates/
Default.md so new GitLab MRs surface the same structured prompt once
Phase 2 lands the pipeline and developers start opening MRs.

Two content adjustments vs the Gitea original:
- PR -> MR in the comment header (GitLab terminology).
- Fixed a stale ref to docs/development.md "section 5" (Observability
  dev-loop); the Conventional Commits convention is in section 7.

Phase 1 ships repo-side artefacts only; ops bootstrap (mirror push,
groups, branch protection, bot signing keys, Renovate endpoint
reconfig) happens on vm-gitlab outside this PR per ADR-0028
section 'Migration sequence'.

.gitlab/merge_request_templates/Default.md

@@ -0,0 +1,30 @@
+<!--
+MR title format — becomes the squash-merge subject on main, validated by commitlint.
+
+  <type>(<scope>): <short description>
+
+Examples:
+  feat(portal-shell): add user-preferences panel skeleton
+  fix(portal-bff): correct env var bracket access
+  docs(decisions): add ADR-0018 for security baseline
+  chore(deps): bump @nx/* to 22.7.2
+
+Imperative mood, lowercase, no trailing period, target ≤ 70 chars.
+See docs/development.md §7 for the full convention (types, scopes).
+-->
+
+## Summary
+
+## Motivation
+
+## Implementation notes
+
+## Verification
+
+- [ ] `pnpm ci:check` green locally
+- [ ] `pnpm ci:audit` green (or pre-existing drift acknowledged)
+- [ ] Tested manually:
+- [ ] Architecture diagram updated (if `docs/architecture.md` was affected)
+- [ ] ADR amended or added (if a decision changed)
+
+## Related