Raise bug-fix workflow credit cap and run pytest from PATH

[gyanu2507]

Description

The agentic bug-fix workflow hit the 1K default credit cap, then failed trying ./.venv/bin/python -m pytest with Permission denied.

This sets max-ai-credits: 2000, allows python as well as python3 on the bash allowlist, and tells the agent to use python3 -m pytest / pytest from PATH instead of a project venv interpreter.

Testing

• Ran existing tests with uv sync && uv run pytest
• uv run pytest tests/test_bug_fix_workflow.py

AI Disclosure

• I did use AI assistance (describe below)

LLM-assisted implementation. I chose the issue, wrote the tests, and ran them locally.

Fixes #4472

[mnriem]

Thanks @gyanu2507 — a process heads-up. This one turns out to touch security-sensitive agentic-workflow infra: the change only takes effect once the compiled bug-fix.lock.yml is regenerated, and that has to be done with the exact pinned gh-aw compiler (v0.79.8), plus a careful diff to confirm nothing else in the lock (container digests, action SHAs, firewall allow-domains) shifts. Rather than ask you to chase our pinned toolchain, I'm going to pick up the recompile and finish this directly on your branch — you'll stay the author and I'll keep your commits.

Two small design tweaks I'm weighing as I do, with rationale to follow in the finishing commit: keeping the credit cap as-is if the pytest-from-PATH fix removes the retry loop that caused the ~8-credit overrun, and keeping the bash allowlist at python3 only unless bare python is genuinely needed. Appreciate you surfacing #4472 and getting it most of the way there.

[gyanu2507]

Sounds good. I'll leave the lockfile recompile and the credit / python allowlist tweaks to you.