feat(bitbucket): add guarded cloud issue comment create

[KatalKavya96]

Summary

• Adds the first narrowly scoped Bitbucket write operation: magpie-bitbucket issue comment <id> --body-file <path> for creating Bitbucket Cloud issue comments.
• Follows Magpie’s existing write-path discipline: the bridge executes an already-confirmed action, while explicit user confirmation remains the responsibility of the calling skill.
• Keeps Bitbucket Data Center native issue comment writes explicitly unsupported and directs users toward linked Jira coverage instead.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)
• Other:

Test plan

• prek run --all-files passes
• For Python packages touched: PYTHONPATH=src uv run --group dev pytest tests/test_bitbucket.py -q
• For Python packages touched: uv run --group dev ruff check src tests --fix
• For Python packages touched: uv run --group dev ruff format src tests
• For Python packages touched: uv run --group dev mypy src tests
• For Groovy bridges touched: command-line invocation tested end-to-end
• For skill changes: eval suite passes for the affected skill
  (PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner tools/skill-evals/evals/<skill>/)
• For skill behaviour changes: a new or updated eval fixture is included in this PR
  (a regression test for the bug fixed / the behaviour added — see CONTRIBUTING.md)
• Other: focused issue-comment creation tests pass and git diff --check is clean

RFC-AI-0004 compliance

• HITL — the bridge does not decide whether to mutate; the calling skill must obtain explicit user confirmation before invoking the write command
• Sandbox — no new unrestricted host access; the existing Bitbucket HTTPS and redirect protections remain in place
• Vendor neutrality — adds a narrow Bitbucket-specific tracker mutation without claiming complete contract:tracker or backend parity
• Conversational + correctable — confirmation remains at the calling-skill boundary, consistent with existing Magpie write workflows
• Write-access discipline — only the explicitly requested Cloud issue-comment mutation is executed; no autonomous comments or broader mutations are added
• Privacy LLM — comment bodies and returned Bitbucket issue-comment content remain external data and follow the existing approved-LLM/privacy handling rules

Linked issues

Refs #606

Notes for reviewers

This is the first write operation in the Bitbucket bridge and intentionally keeps the scope small.

The new command is:

magpie-bitbucket issue comment <id> --body-file <path>

The write path follows the same discipline documented by the existing Jira bridge: the bridge executes the mutation, but confirmation is owned by the calling skill. There is deliberately no bridge-level --confirm flag.

Implementation details:

• Bitbucket Cloud only
• sends a JSON POST to the issue comments endpoint
• reads the comment body from --body-file
• rejects missing or whitespace-only body files before any outbound write
• reuses quoted path segments and authenticated HTTPS handling
• write requests reject redirects rather than replaying a mutation elsewhere
• normalizes the created comment through the existing issue-comment helpers
• Bitbucket Data Center returns an explicit unsupported error with linked Jira guidance

Tests cover the Cloud POST request/body, Data Center rejection, response normalization, CLI success, and missing/empty body failures before the mutation path is invoked.

All broader writes — issue updates, PR comments/reviews, task mutation, decline/merge, branch changes, and build mutations — remain out of scope for this PR.

[KatalKavya96]

Hi @potiuk , I opened the next Bitbucket follow-up for #606.

This is the first narrowly scoped write path:

magpie-bitbucket issue comment <id> --body-file <path>

It follows the existing Magpie/Jira write discipline: explicit user confirmation stays in the calling skill, while the bridge only executes the already-confirmed mutation.

Scope is Cloud-only; Data Center native issue-comment writes remain explicitly unsupported with linked Jira guidance. Missing/empty body files fail before any outbound write, and write requests reuse the existing auth/HTTPS protections while refusing redirects.

Focused/full pytest, ruff, mypy, git diff --check, and prek run --all-files are passing.