feat(bitbucket): add guarded cloud PR approve actions

[KatalKavya96]

Summary

Adds guarded Bitbucket Cloud pull-request approval mutations to the existing Bitbucket bridge.

This PR adds:

• magpie-bitbucket pr approve <id>
• magpie-bitbucket pr unapprove <id>

The commands operate on Bitbucket Cloud only. Bitbucket Data Center approval writes remain explicitly unsupported in this PR.

Implementation

• Adds a shared guarded write request helper supporting:

  • POST responses with JSON bodies
  • bodyless DELETE responses such as Bitbucket Cloud's 204 No Content
  • existing HTTPS enforcement
  • existing redirect rejection for authenticated mutations

• Adds Bitbucket Cloud approve and unapprove API calls.

• Adds explicit Data Center fail-closed behavior.

• Adds normalized approval mutation output.

• Adds CLI dispatch for pr approve and pr unapprove.

• Keeps the broader post_review contract marked as not implemented.

Safety / write-path discipline

These remain explicit caller-confirmed mutations.

The bridge does not perform approval writes automatically. The calling skill is responsible for obtaining explicit user confirmation before invoking the mutation.

Authenticated writes continue to reject redirects rather than forwarding credentials to a redirected destination.

Tests

Added coverage for:

• Cloud approve using POST with no request body
• Cloud unapprove using DELETE with an empty response body
• normalized approve/unapprove results
• CLI approve/unapprove dispatch
• Data Center fail-closed behavior
• redirect rejection for mutation requests

Validation completed successfully:

• full Bitbucket test suite
• focused approve/unapprove tests
• Ruff
• Ruff format check
• mypy
• repository prek hooks
• git diff --check

Scope

This intentionally remains a narrow follow-up to #606.

It does not add:

• full post_review
• request-changes mutations
• PR decline
• PR merge
• Data Center approval writes

[KatalKavya96]

Hi @potiuk — this is the next narrow #606 follow-up after the Cloud PR-comment write.

It adds guarded Bitbucket Cloud pr approve / pr unapprove actions, keeps Data Center approval writes fail-closed, reuses the existing HTTPS + no-auth-redirect write path, and intentionally leaves full post_review unimplemented.

The full Bitbucket test suite, Ruff, mypy, prek hooks, and git diff --check are green.

Would appreciate your review when you get a chance.