feat(bitbucket): add read-only cloud issue comments fetch

[KatalKavya96]

Summary

• Adds magpie-bitbucket issue comments <id> for read-only Bitbucket Cloud issue comment fetching where the repository issue tracker is enabled.
• Extends the partial contract:tracker coverage added by Cloud issue list/get with read-only issue discussion context, while keeping Bitbucket Data Center native issue comments explicitly unsupported with linked Jira handoff guidance.
• Normalizes Cloud issue comments into stable partial read-only tracker context without adding issue comment creation, edits, deletion, state transitions, assignment changes, or any repository mutation path.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators`)
• Other:

Test plan

• prek run --all-files passes
• For Python packages touched: PYTHONPATH=src uv run --group dev pytest tests/test_bitbucket.py -q -k "issue_comments or issue_comment"
• For Python packages touched: PYTHONPATH=src uv run --group dev pytest tests/test_bitbucket.py -q
• For Python packages touched: uv run --group dev ruff check src tests --fix
• For Python packages touched: uv run --group dev ruff format src tests
• For Python packages touched: uv run --group dev mypy src tests
• For Groovy bridges touched: command-line invocation tested end-to-end
• For skill changes: eval suite passes for the affected skill
  (PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner tools/skill-evals/evals/<skill>/)
• For skill behaviour changes: a new or updated eval fixture is included in this PR
  (a regression test for the bug fixed / the behaviour added — see CONTRIBUTING.md)
• Other: git diff --check passes

RFC-AI-0004 compliance

• HITL — no mutation behaviour is added; the new command is read-only
• Sandbox — no new unrestricted host access; Bitbucket network reach remains declared in the adapter
• Vendor neutrality — extends the existing Bitbucket contract:change-request / partial contract:tracker bridge without claiming complete backend parity
• Conversational + correctable — agentic-override path remains documented for adopter-tunable behaviour
• Write-access discipline — this PR only reads Cloud issue comments and does not create, edit, delete, resolve, assign, or otherwise mutate issues, comments, PRs, builds, or repository state
• Privacy LLM — fetched issue comments, commenter names, links, and raw Bitbucket payloads remain external data and are emitted as read-only bridge output for the caller to handle under existing privacy/approved-LLM rules

Linked issues

Refs #606

Notes for reviewers

This follows the recently merged Bitbucket Cloud issue read PR and adds the next conservative tracker-side read.

The new command is:

magpie-bitbucket issue comments <id>

Scope is intentionally narrow:

• Bitbucket Cloud: supports read-only issue comment fetching with pagination where the repository issue tracker is enabled.
• Bitbucket Data Center: native Bitbucket issue comments are explicitly unsupported and return a clear error pointing toward linked Jira coverage instead.

The normalized output includes issue ID, comment ID, author, body, timestamps, permalink, participants, labels/coverage context, and raw backend payloads.

This remains partial read-only. It does not add issue comment creation, edits, deletion, assignment changes, state transitions, linked Jira handoff, PR mutation, build mutation, or repository content changes.

[KatalKavya96]

Hi @potiuk, I opened the next Bitbucket follow-up for #606.

This adds read-only Cloud issue comment fetching:

magpie-bitbucket issue comments <id>

It keeps the same partial contract:tracker scope, with Data Center native issue comments explicitly unsupported and pointed toward linked Jira coverage.

Targeted pytest, ruff, mypy, and git diff --check are passing.

[potiuk]

Approve — with a few optional nits. Clean, narrowly-scoped read-only addition that faithfully follows the existing Bitbucket bridge patterns and is well-tested. No blocking issues.

Correctness looks solid:

• Pagination reuses the vetted _validated_next_url loop-guard (same scheme/host enforcement + repeated-URL rejection) — no infinite-loop or redirect risk.
• URL construction uses quote_path and hits the correct Cloud endpoint; DC rejects before any normalize call.
• Helper reuse (_cloud_user, _cloud_issue_content, _cloud_timestamp, _cloud_link, _participants) is all correct — _participants keys off the author field the normalizer sets.

Nits (none blocking):

1. _cloud_issue_comment sets "deleted": raw.get("deleted") raw, bypassing the _bool_or_none convention used elsewhere for optional booleans. Suggest _bool_or_none(raw.get("deleted")) for consistency/robustness — this is the one I'd actually fold in.
2. The kind != "cloud" branch in normalize.issue_comments (_unsupported_issue_comment) is unreachable via the CLI, since datacenter.get_issue_comments raises first. Harmless, but it's dead/untested in practice — worth dropping or a one-line note on why it's kept.
3. Optional: a CLI-level test for issue comments <id> against a Data Center env (non-zero exit + guidance message) would mirror the Cloud CLI test; the backend-level test already covers the raise.

Docs are consistently updated across labels-and-capabilities.md, the tool README, and adapters.md, and the README renumbering is correct. Read-only / no-mutation scope matches the RFC-AI-0004 claims. Thanks!