Add exit-code tests for extracted github-agile scripts; fix bump-and-tag docstring

[sebastientaggart]

Summary

Adds the deferred exit-code contract tests for the extracted github-agile scripts (#165). Their behavior was validated by hand each time a skill workflow ran end-to-end; these tests pin the documented exit codes so argument-handling, exit-code, or guarded-sequence drift can't slip through unnoticed.

What's here

• tests/test_github_agile_scripts.py — 35 network-free tests, one TestCase per script, covering a success path plus every documented non-zero exit for all 8 scripts (make-workdir, post-issue-comment, sync-base-branch, list-open-milestones, list-sub-issues, label-create, label-audit, bump-and-tag).

  • Hyphenated scripts are loaded by path via importlib; subprocess.run is mocked in-process with ordered fake results; the CWD-dependent label-audit runs inside a temp dir. No network, no live gh/git.
  • Pins the subtle contracts too: label-create's warn-and-continue (a failed label still exits 0), sync-base-branch's dirty-tree (1) vs. git-failure (2) split, and list-open-milestones' open-only filtering.

• skills/github-agile/scripts/bump-and-tag.py — docstring fix: the documented 4 bad arguments exit was unreachable (the script uses argparse with required=True, which exits 2 on bad args and never returns 4). Removed the phantom 4 and documented argparse's real behavior. No functional change; the bump-and-tag test pins the actual SystemExit code 2.

Test plan

• make test → 163 tests, OK (128 existing + 35 new; the new file is auto-discovered by the test_*.py pattern, no Makefile change).
• make check → passes (sync.py --validate, permissions, command-shape).

Closes #165

[sebastientaggart]

Code review — medium effort

Scope: tests/test_github_agile_scripts.py (new) + bump-and-tag.py docstring fix. make test → 163 passing; make check green. No sensitive-area surfaces (test code + docstring) — sensitive-area gate not triggered. No correctness issues: the mocks feed ordered subprocess.run results and each test asserts the real returned exit code.

[NOTE] tests/test_github_agile_scripts.py — bump-and-tag.py's fallback path (tag missing after bump → create annotated git tag -a, exit 3 if that fails) isn't exercised; tests cover only the tag-present branch. The ticket asks for one test per documented exit code, and exit 3 is covered via the push-failure case, so this is complete as specced — noting the untested branch for a future hardening pass.

[NOTE] tests/test_github_agile_scripts.py:~95 — __import__("shutil").rmtree(...) in addCleanup would read cleaner as a top-level import shutil. Cosmetic.

Verdict: APPROVE