fix: clear stale workspace lock tags and improve lock error messages (CLOUD-933)

[MeNsaaH]

Summary

• Export TFLockTagPrefix from tfc_trigger so other packages can reference the tag name without duplication
• Fix lock error messages: when a TFC workspace is locked by TFBuddy, the error now includes a full clickable MR URL (derived from the current MR's web URL) instead of a bare IID; when locked by TFC natively with no tag, the message directs users to the TFC UI
• Auto-release stale lock tags: after an apply-triggered run reaches a terminal state (applied, errored, canceled, discarded), releaseWorkspaceLockTag removes the tfbuddylock-<MR_IID> workspace tag, preventing it from blocking future applies while the MR stays open

Test Plan

• go test ./pkg/tfc_trigger/... — 3 new tests covering TFC-lock + tag, TFC-lock + no tag, and tag-only lock scenarios
• go test ./pkg/vcs/gitlab/... — 3 new tests: tag removed on RunApplied, tag removed on RunErrored, tag not removed for plan action
• Trigger an apply via TFBuddy on a GitLab MR; after the run completes, confirm the tfbuddylock-<IID> tag is gone from the TFC workspace
• With a locked workspace, trigger an apply and verify the error comment contains a full MR URL

Fixes CLOUD-933

🤖 Generated with Claude Code