fix: guard TaskBounty candidate issue updates

[Abu1982]

Summary

TaskBounty candidate handling now records whether agent credentials are available so later workflow steps can make safe permission-aware decisions. Candidate issue creation and updates are skipped when the scout only has public read-only access, preventing unauthorized write attempts.

Closes #2

Changes

• TaskBounty credential handling: records the availability of TaskBounty agent credentials for reuse by downstream workflow steps.
• TaskBounty candidate issue workflow: prevents opening or updating candidate issues when only public read-only scout access is available.
• TaskBounty regression tests: adds coverage for the read-only access path to ensure candidate issue writes are not attempted without credentials.

Testing

Run the regression test suite:

pytest

Edge Cases Considered

• Scout runs with public read-only access and no TaskBounty agent credentials.
• Valid TaskBounty agent credentials are present and candidate issue writes should still proceed.
• Downstream workflow steps need to distinguish missing credentials from other workflow failures.

Notes

No migration steps or breaking changes are expected. Follow-up may be needed if additional TaskBounty workflows also need explicit credential availability checks.