feat(bitbucket): add guarded cloud PR comment create

[KatalKavya96]

Summary

• Adds magpie-bitbucket pr comment <id> --body-file <path> for creating a top-level Bitbucket Cloud pull-request comment.
• Reuses the existing guarded write path: HTTPS-only JSON POSTs, redirect rejection, quoted path segments, body-file input, and caller-side explicit confirmation.
• Keeps Bitbucket Data Center PR comment writes explicitly unsupported for this PR so the mutation surface stays narrow.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)
• Other:

Test plan

• For Python packages touched: full Bitbucket pytest suite passes

• ruff check src tests passes

• ruff format --check src tests passes

• mypy src tests passes

• git diff --check passes

• Focused PR-comment tests cover:

  • Cloud POST URL and JSON body
  • Data Center unsupported behaviour
  • created-comment normalization
  • CLI success
  • empty body rejection before write
  • missing body-file rejection before write

• prek run --all-files passes

• For Groovy bridges touched: command-line invocation tested end-to-end

• For skill changes: eval suite passes for the affected skill

• For skill behaviour changes: a new or updated eval fixture is included

RFC-AI-0004 compliance

• HITL — the bridge executes an already-confirmed mutation; explicit confirmation remains the responsibility of the calling skill.
• Sandbox — no new unrestricted host access; the existing Bitbucket network boundary is reused.
• Vendor neutrality — extends the existing partial Bitbucket change-request adapter without claiming complete backend parity.
• Conversational + correctable — the caller remains responsible for presenting and confirming the proposed comment before invoking the write.
• Write-access discipline — only one explicitly requested top-level PR comment is created; no autonomous review, approval, decline, merge, or task mutation is added.
• Privacy LLM — pull-request comment content remains external repository data and follows the existing privacy / approved-LLM handling rules.

Linked issues

Refs #606
Follow-up to #1078

Notes for reviewers

This is the next narrowly scoped Bitbucket write after Cloud issue-comment creation.

The new command is:

magpie-bitbucket pr comment <id> --body-file <path>

Implementation details:

• Bitbucket Cloud only
• sends JSON to the existing pull-request comments endpoint
• reads the comment body only from --body-file
• rejects missing or whitespace-only body files before any outbound mutation
• reuses post_json(), including HTTPS enforcement and redirect rejection
• quotes the pull-request ID as a path segment
• normalises the created comment through the existing Cloud pull-request comment normalizer
• keeps Bitbucket Data Center PR comment writes explicitly unsupported

Out of scope for this PR: inline comments, comment edits/deletion, PR task mutation, review submission, approve/unapprove, decline, merge, PR creation/editing, issue mutation, or build mutation.

[KatalKavya96]

Hi @potiuk, this continues the guarded Bitbucket write rollout after #1078.

This adds one narrow mutation: top-level Bitbucket Cloud PR comment creation via pr comment <id> --body-file <path>.

It deliberately reuses the existing write-path protections from issue-comment creation: caller-side confirmation, body-file-only input, HTTPS enforcement, redirect rejection, and quoted path segments. Data Center PR comment writes remain explicitly unsupported in this PR.

Tests cover the POST request/body, normalization, CLI success, Data Center rejection, and missing/empty body failures before any write occurs.