fix(forge): let a detected forge vouch for its host, and derive one profile rule

Two features that landed in parallel disagreed about the same host. The probe
marks a detected GitLab `recognized`, which is what lets the panel spend a
request on it; `resolve_forge_auth` then answered that request with "not a
forge codeg speaks", because it consulted only the hostname. A real GitLab at
`git.corp.example` with no account was reported as unsupported instead of as
the missing account it is. Only a positive verdict vouches: "asked, and it is
not a GitLab" stays unsupported, which is the Bitbucket case.

`host_profile` now derives the mount path, the provider and `recognized` from
`host_profile_in` and lets the probe replace only the provider, so the rule the
two halves share is written once.