test: cover run_bash_script endpoint

[cm2435-hcomp]

Summary

• exercise POST /run_bash_script through the Flask test client
• verify a harmless script runs in the requested working directory and returns the documented result shape
• run the regression test on Python 3.12 for pushes and pull requests

Motivation

The public OSWorld V2 AMI currently returns HTTP 500 from this endpoint because its server source references an undefined _append_event. The source-level fix is already present on main, but there was no executable test protecting the route. See xlang-ai/OSWorld-V2#423 for the separate stale-image report.

Verification

uv run --python 3.12 python -m unittest discover -s tests -v

test_executes_script_and_returns_output ... ok
Ran 1 test in 0.020s
OK

The AMI still needs a post-build smoke: this PR can prevent a source regression, but cannot prove that a published image contains the pinned source.