CLA Group detail URL should use the group id

[ahmedomosanya]

Summary

Key the Org Lens EasyCLA detail page on claGroupId. A card link also carries the signature so two list rows for the same group stay distinct. A URL with only the group id shows the newest signed agreement for that group on the selected organization.

return_url becomes /org/easycla/<claGroupId> plus the existing org query and a return flag (so a DocuSign return is not treated as a cold visit). Drop /org/easycla/new and the session stash used to hop from the list after sign. The picker opens /org/easycla/<claGroupId> — the same page as a card or a return. Do not add a reserved /signed return hop.

Parent: #1978

Why

The list and the sign picker are organization-scoped. The picker already refuses a CLA group the organization has signed, and there is no signing-entity choice, so a new corporate sign on this path cannot create a second row for that group. The group id is known before the envelope exists, so it can be the return_url.

#1978 locked the path on signature id so two list rows for one group would not collide. Keep that by putting the signature on every card link. The bare group URL is the shareable / return address.

Today's shipped return (#2306) sends DocuSign to the list (/org/easycla?org=) and hops from a session stash. That hop goes away: new envelopes return to the group URL. No list-hop fallback — the feature is still flagged; there are no live envelopes on the old address.

#2293 already asks for this same group-id URL as the unsigned signing overview. This issue must not send an unsigned visit to the list or treat it as a signed detail.

What this page does

Visit	This ticket
Card (signature on the link)	That row's signed detail
Bare group URL, org has a signed row	Newest signed row for that group
Flagged DocuSign return	Retry the signed list until a row for that group exists, then newest
Picker → this URL, org has not signed	Unsigned preview. Names come from the picker's history state (what /new does today). Reload of that tab still works while the history entry is there.
Bare group URL, org has not signed, no picker state (paste / other session)	Stay on /org/easycla/<claGroupId>. Do not redirect to the list. Do not render signed detail. Show that this group cannot be previewed here yet. #2293 replaces that with a named preview (get-by-id or equivalent).

Scope

In

• Detail route keyed on claGroupId
• Card → /org/easycla/<claGroupId> plus signature
• Bare group URL, signed row present → newest signed row for that group
• Picker → /org/easycla/<claGroupId> (unsigned preview when the org has not signed; names from the picker's history state)
• Pasted unsigned group URL with no picker state → stay on this URL; not the list; not signed detail
• return_url is the group detail, with a return flag
• After a flagged return, retry the org list until a signed row for that group exists (same retry budget as today's list hop), then newest
• Remove /new and the post-sign stash / list hop
• Adopt ?org= on this page the same way the list already does

Out

• Add per-CLA-Group deep link for signing overview page #2293 (pasted unsigned group URL that must resolve names without history state)
• A reserved /signed return route
• A producer API for in-progress (signed=false) signatures, or relaxing the signed-list filter
• Signing-entity picker
• A list-page hop for old return_urls

Do not

• Do not send an unsigned group URL to the list. That contradicts Add per-CLA-Group deep link for signing overview page #2293.
• Do not treat every visit to the group URL as a DocuSign return. Only the return flag waits for a signed row.

Test plan

• Card opens the row that was clicked when two cards share a group
• Pasted /org/easycla/<claGroupId> for a signed group opens the newest signed row
• Search → continue opens /org/easycla/<claGroupId> as the unsigned preview (no /new)
• Reload of that preview still shows the group (history state still present)
• Pasted unsigned /org/easycla/<claGroupId> (no picker state) stays on that URL and does not open the list or a signed page
• New DocuSign return lands on that group's signed detail, not the list
• Return before the list has the new row waits, then opens detail
• /new is gone; no /signed route ships