fix(cloud-agent-next): preserve bitbucket capability origin in worker sanitize

[St0rmz1]

Summary

The worker-side sanitizeBitbucketCodeReviewRemote in session-service.ts
unconditionally stripped the credential from a Bitbucket code-review origin. For
a credential-contained session, that origin holds a kbb1. outbound capability
that must stay in place so a blobless clone's lazy blob fetches can authenticate
through the outbound interceptor. This adds a guard that skips the strip when the
session is contained, mirroring the wrapper's sanitizeBitbucketCodeReviewRemote.
Follows up on a review comment on #4872.

Changes

• session-service.ts: in sanitizeBitbucketCodeReviewRemote, return early and
  leave the origin untouched when getEffectiveCredentialContainment(metadata).bitbucket
  is true. A non-contained (raw-token) session is still stripped as before.
• session-service.test.ts: added cold and warm prepareWorkspace tests for a
  contained Bitbucket review, asserting the origin is not stripped
  (updateGitRemoteUrl not called) and, on warm resume, the token refresh is
  skipped (updateGitRemoteToken not called). Added an
  issueCloudAgentBitbucketSessionCapability mock and a containment override to
  the createBitbucketMetadata helper to support them.

Verification

No manual run. This is an internal credential-handling guard, covered by unit
tests. Full session-service.test.ts passes (94 tests), and I confirmed the new
tests actually cover the guard: with the guard removed, both contained-path tests
fail because the strip runs (updateGitRemoteUrl called once). Typecheck, lint,
and format clean.

• No manual testing performed (unit-tested internal guard)

Visual Changes

N/A

Reviewer Notes

• Addresses pandemicsyn's follow-up comment on feat(bitbucket) blobless wrapper #4872: the worker-side sanitize
  had no capability check, unlike the wrapper's version.
• The guard keys off the containment flag rather than the token because the
  function only receives metadata. When credentialContainment.bitbucket is
  true a capability was issued, so the origin is safe to keep.
• Non-contained Bitbucket sessions are unchanged (still stripped).

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the bitbucket capability-preservation fix and its two new cold/warm-path regression tests; the change is small, correctly gated by getEffectiveCredentialContainment(metadata).bitbucket, and backward-compatible for legacy metadata, with no security, correctness, or typo issues found.

Files Reviewed (2 files)

• services/cloud-agent-next/src/session-service.ts
• services/cloud-agent-next/src/session-service.test.ts

---

_{Reviewed by claude-sonnet-5 · Input: 34 · Output: 10.2K · Cached: 1.1M}

_{Review guidance: REVIEW.md from base branch main}