feat(bitbucket): add read-only cloud issue attachments fetch

[KatalKavya96]

Summary

• Adds magpie-bitbucket issue attachments <id> for read-only Bitbucket Cloud issue attachment fetching where the repository issue tracker is enabled.
• Extends the partial contract:tracker coverage after Cloud issue list/get/comments with attachment context, while keeping Bitbucket Data Center native issue attachments explicitly unsupported with linked Jira handoff guidance.
• Normalizes Cloud issue attachments into stable partial read-only tracker context without adding attachment upload, deletion, issue edits, state transitions, assignment changes, or any repository mutation path.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)
• Other:

Test plan

• prek run --all-files passes
• For Python packages touched: PYTHONPATH=src uv run --group dev pytest tests/test_bitbucket.py -q -k "issue_attachments or issue_attachment"
• For Python packages touched: PYTHONPATH=src uv run --group dev pytest tests/test_bitbucket.py -q
• For Python packages touched: uv run --group dev ruff check src tests --fix
• For Python packages touched: uv run --group dev ruff format src tests
• For Python packages touched: uv run --group dev mypy src tests
• For Groovy bridges touched: command-line invocation tested end-to-end
• For skill changes: eval suite passes for the affected skill
  (PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner tools/skill-evals/evals/<skill>/)
• For skill behaviour changes: a new or updated eval fixture is included in this PR
  (a regression test for the bug fixed / the behaviour added — see CONTRIBUTING.md)
• Other: git diff --check passes

RFC-AI-0004 compliance

• HITL — no mutation behaviour is added; the new command is read-only
• Sandbox — no new unrestricted host access; Bitbucket network reach remains declared in the adapter
• Vendor neutrality — extends the existing Bitbucket contract:change-request / partial contract:tracker bridge without claiming complete backend parity
• Conversational + correctable — agentic-override path remains documented for adopter-tunable behaviour
• Write-access discipline — this PR only reads Cloud issue attachments and does not upload, delete, edit, assign, resolve, or otherwise mutate issues, attachments, comments, PRs, builds, or repository state
• Privacy LLM — fetched issue attachment names, uploader names, links, and raw Bitbucket payloads remain external data and are emitted as read-only bridge output for the caller to handle under existing privacy/approved-LLM rules

Linked issues

Refs #606

Notes for reviewers

This follows the recently merged Bitbucket Cloud issue list/get and issue comments PRs, adding the next conservative tracker-side read.

The new command is:

magpie-bitbucket issue attachments <id>

Scope is intentionally narrow:

• Bitbucket Cloud: supports read-only issue attachment fetching with pagination where the repository issue tracker is enabled.
• Bitbucket Data Center: native Bitbucket issue attachments are explicitly unsupported and return a clear error pointing toward linked Jira coverage instead.

The normalized output includes issue ID, attachment ID, name/filename, size, uploader, timestamps, download/permalink links, and raw backend payloads.

This remains partial read-only. It does not add attachment upload, deletion, issue edits, comment mutation, assignment changes, state transitions, linked Jira handoff, PR mutation, build mutation, or repository content changes.

[KatalKavya96]

Hi @potiuk, I opened the next Bitbucket follow-up for #606.

This adds read-only Cloud issue attachment fetching:

magpie-bitbucket issue attachments <id>

It keeps the same partial contract:tracker scope, with Data Center native issue attachments explicitly unsupported and pointed toward linked Jira coverage.

Targeted pytest, full Bitbucket pytest, ruff, mypy, and git diff --check are passing.