test(bitbucket): pin redirect rejection for authenticated requests

[KatalKavya96]

Bitbucket redirect guard regression test

Summary

• Adds direct regression coverage for NoAuthRedirectHandler.
• Pins the security property called out during review of feat(bitbucket): add guarded cloud issue comment create #1078: authenticated Bitbucket requests using this handler must reject redirects rather than forward credentials or allow a write to be replayed at a redirect target.
• Test-only follow-up; no runtime behaviour or documentation changes.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)
• Other:

Test plan

• prek run --all-files passes

• For Python packages touched: uv run pytest / ruff check / mypy passes

• For Groovy bridges touched: command-line invocation tested end-to-end

• For skill changes: eval suite passes for the affected skill
  (PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner tools/skill-evals/evals/<skill>/)

• For skill behaviour changes: a new or updated eval fixture is included in this PR
  (a regression test for the bug fixed / the behaviour added — see CONTRIBUTING.md)

• Other:

  • PYTHONPATH=src uv run --group dev pytest tests/test_bitbucket.py -q -k "redirect_handler"
  • full tests/test_bitbucket.py suite passes
  • uv run --group dev ruff format --check src tests
  • git diff --check
  • prek run --all-files passes all relevant checks; check-family-plugins currently fails on an unrelated upstream-main marketplace sync issue (magpie-utilities missing the report-framework-issue family symlink)

RFC-AI-0004 compliance

No behavioural or mutation changes are introduced by this PR.

• HITL — any new mutation is gated on explicit user confirmation
• Sandbox — no new unrestricted host access; network reach declared in the adapter
• Vendor neutrality — placeholders (<PROJECT>, <tracker>, <upstream>, <security-list>) used in all skill / tool prose (the check-placeholders prek hook is the mechanical gate)
• Conversational + correctable — agentic-override path documented if behaviour is adopter-tunable
• Write-access discipline — no autonomous outbound messages; drafts only, sent on confirmation
• Privacy LLM — private content does not reach a non-approved LLM; redactor invoked where needed

Linked issues

Refs #606
Follow-up to #1078

Notes for reviewers

This directly addresses the non-blocking review note from #1078.

SameHostRedirectHandler already had direct redirect-behaviour coverage, while NoAuthRedirectHandler did not. The latter now guards the first Bitbucket write path, so this test pins the intended behaviour explicitly: any redirect attempt raises BitbucketError instead of producing a redirected authenticated request.

The change is intentionally limited to tools/bitbucket/tests/test_bitbucket.py.

[KatalKavya96]

Hi @potiuk, followed up on the non-blocking nit from #1078.

This adds direct regression coverage for NoAuthRedirectHandler, pinning the security property that authenticated Bitbucket requests reject redirects rather than forwarding credentials or allowing a mutation to be replayed at the redirect target.

It is intentionally test-only: one file changed, no runtime or docs changes.

Focused redirect tests, full Bitbucket pytest, ruff, formatting, mypy, and git diff --check pass. prek run --all-files also passes all relevant checks; the only failure is the unrelated current-main check-family-plugins sync issue.

[onlyarnav]

LGTM!

The prek CI workflow failed on check-family-plugins due to an unrelated upstream-main marketplace sync issue (magpie-utilities missing the report-framework-issue family symlink), as noted in the PR description. Core test suites (pytest (bitbucket), CodeQL, Analyze (python)) are all green.