- creates a merge request via GitLab API (curl + GITLAB_TOKEN, PRIVATE-TOKEN header)
- derives host + project path from git remote origin (or GITLAB_HOST); no hardcoded URLs
- refuses to open an MR from a protected source branch; MR_PUSH/MR_DRY_RUN toggles
- optionally attaches the MR link to a Jira ticket via link-mr.sh
- verified parsing for ssh (scp-form) and https remotes incl. nested namespaces
