fix(bots): give the engineer-bot e2e repro a token the env scrub can't strip

[eric-wang-1990]

Problem

The engineer-bot's bug-fix flow requires a live tests/e2e repro. The e2e suite authenticates through conftest.py, which reads the token from DATABRICKS_TOKEN. But the bot runs pytest inside an agent-driven subprocess whose env is scrubbed of every credential-shaped variable (the engine's shared/env_scrub.py strips *TOKEN*/*SECRET*/*PASSWORD*/…). So DATABRICKS_TOKEN is removed before pytest starts, the connection is built with access_token=None, and it hangs.

Observed on #791: every e2e test — including existing, unmodified ones — stalled ~10 min per attempt, burning the 45-min job timeout. The same warehouse and azure-prod secrets are used by code-coverage.yml's e2e job, which passes only because it runs pytest directly (no agent, no scrub). That's the whole difference; it is not warehouse cold-start.

Fix

Pass the connection details through a file instead of a credential-named env var — the pattern the engine's centralize-bot-workflows design doc prescribes verbatim.

• engineer-bot.yml: a new step writes host/http_path/token/user/catalog to $RUNNER_TEMP/e2e-connection.json (built with jq so the secret is never shell-interpolated; chmod 600) and exports its path to the author step as DATABRICKS_TEST_CONFIG_FILE — a name env_scrub deliberately preserves.
• conftest.py: each connection fixture now falls back to that file when its env var is absent. The env var still wins, so normal CI and local dev are byte-for-byte unchanged (they leave the path var unset → empty file dict).

Author phase only. The follow-up phase deliberately runs mocked tests/unit and forbids tests/e2e, so it needs no live token — left untouched.

Verification

• YAML validated.
• Simulated both paths against the real fixtures: (a) token scrubbed + config file present → access_token resolves from the file; (b) token present + no config file → env token, unchanged.
• End-to-end confirmation is the next re-trigger of the engineer-bot on Cursor.close() leaks server-side handle for async commands that were never fetched #791 after this merges.

This pull request and its description were written by Isaac.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[peco-review-bot]

Verdict: 1 Low

Looks good — a clean, well-scoped fix that passes the e2e token through a file (DATABRICKS_TEST_CONFIG_FILE) the env scrub preserves, keeping the env var as the winning source so normal CI/local dev is unchanged. One low note about the or-based fallback changing empty-string-vs-unset semantics for the fixtures. Nit: _test_config_from_file only guards OSError/ValueError; a valid-but-non-object JSON (e.g. a bare string/list) would pass json.load and later raise AttributeError on .get(...) in the fixtures — not reachable given the jq -n '{...}' writer, but a isinstance(..., dict) check would harden it."