feat(bitbucket): add guarded cloud PR decline

[KatalKavya96]

Summary

Adds a guarded Bitbucket Cloud pull-request decline mutation to the existing Bitbucket bridge.

This PR adds:

• magpie-bitbucket pr decline <id>

The command operates on Bitbucket Cloud only. Bitbucket Data Center decline writes remain explicitly unsupported in this PR.

Implementation

• Adds Bitbucket Cloud pull-request decline using POST.
• Reuses the existing guarded HTTPS-only write path.
• Keeps authenticated mutation redirects rejected.
• Adds explicit Data Center fail-closed behavior.
• Adds normalized decline output.
• Adds CLI dispatch for pr decline <id>.
• Updates Bitbucket bridge documentation and adapter coverage.

Safety / write-path discipline

Decline remains an explicit caller-confirmed mutation.

The bridge does not decline pull requests automatically. The calling skill is responsible for obtaining explicit user confirmation before invoking the command.

Tests

Added coverage for:

• Cloud decline using POST with no request body
• decline response handling
• normalized decline output
• CLI pr decline dispatch
• Data Center fail-closed behavior

Validation completed successfully:

• focused decline tests
• full Bitbucket test suite
• Ruff
• Ruff format check
• mypy
• repository prek hooks
• git diff --check

Scope

This intentionally remains a narrow follow-up to #606.

It does not add:

• full post_review
• PR merge
• Data Center decline writes

[KatalKavya96]

Hi @potiuk — another narrow #606 follow-up, continuing the Cloud PR mutation sequence.

This adds guarded pr decline <id>, reuses the existing HTTPS + no-auth-redirect write path, and keeps Data Center decline explicitly fail-closed.

Focused decline tests, the full Bitbucket suite, Ruff, mypy, prek hooks, and git diff --check are green.

Would appreciate your review when you get a chance.

[potiuk]

Pushed a one-line fixup rather than round-tripping: dropped declining, from the out-of-scope write list in tools/bitbucket/README.md, exactly as @AmirF194 identified — the paragraph claimed decline as implemented and out of scope at the same time, and the command table already listed pr decline <id>. Everything else was a clean match for the #1192 pattern, so this is merged. Thanks both — nice catch on the contradiction.