fix: avoid crashes in job bundle submission edge cases

[crowecawcaw]

Fixes:

What was the problem/requirement? (What/Why)

Three crash/robustness bugs in job-bundle submission (api/_submit_job_bundle.py):

• asset_manager was only assigned inside the attachments block but passed unconditionally to _save_debug_snapshot → UnboundLocalError when submitting a bundle with no attachments and a debug snapshot.
• job["lifecycleStatusMessage"] was read without a fallback → KeyError made a successful submit look like a crash.
• config wasn't forwarded to _upload_attachments/_snapshot_attachments, so telemetry used the wrong config.

What was the solution? (How)

• Initialize asset_manager = None before the conditional and accept Optional[S3AssetManager] in _save_debug_snapshot (it's only dereferenced inside the attachments branch).
• Use job.get("lifecycleStatusMessage", "") in both waiter branches.
• Forward config=config to both attachment helpers.

What is the impact of this change?

Debug-snapshot submissions without attachments no longer crash, successful submits report success, and attachment telemetry uses the correct config.

How was this change tested?

Added red-green unit tests for each: no-attachments debug snapshot, missing lifecycleStatusMessage, and config forwarded to the attachment helpers.

• Have you run the unit tests? Yes — test_job_bundle_submission.py and adjacent bundle-submit tests (58 passed).
• Have you run the integration tests? No.

Was this change documented?

• No public-contract change.
• README.md not affected.

Does this PR introduce new dependencies?

• This PR adds one or more new dependency Python packages.
• This PR does not add any new dependencies.

Is this a breaking change?

No.

Does this change impact security?

No. (Known-path containment (C-known-path) and the stack-trace sanitizer are handled in separate PRs; the session-context race and debug-snapshot command-injection findings are out of scope here.)

Testing

All verification is automated unit tests (no live AWS calls; deadline/boto3 clients mocked), each proven red-green against the pre-fix parent commit:

Fix (a) — asset_manager UnboundLocalError:

• test_create_job_from_job_bundle_debug_snapshot_no_attachments: debug snapshot of a bundle with no attachments completes cleanly; snapshot files are written, no job is submitted, and the generated submit_job.sh contains aws deadline create-job but correctly omits aws s3 cp lines. Pre-fix failure: UnboundLocalError: cannot access local variable 'asset_manager'.
• test_create_job_from_job_bundle_debug_snapshot_with_attachments (new): the other side of the Optional[S3AssetManager] change — a snapshot with attachments uses _snapshot_attachments (not _upload_attachments) with a bound asset manager, writes attachments into create_job_args.json, and emits the aws s3 cp upload commands in the generated script.

Fix (b) — missing lifecycleStatusMessage:

• test_wait_for_create_job_to_complete_missing_status_message, parametrized over both waiter branches: a get_job response omitting lifecycleStatusMessage returns (True, "") for READY and (False, "") for CREATE_FAILED. Pre-fix failure: KeyError: 'lifecycleStatusMessage' in each branch. (Note: the shared MockDeadlineBackend used by UI/e2e tests always includes lifecycleStatusMessage, so this unit test is the permanent coverage for the omission case.)

Fix (c) — config forwarding:

• test_create_job_from_job_bundle_forwards_config_to_upload_attachments: normal submit forwards the caller's config object to _upload_attachments (verified by identity, is). Pre-fix failure: config absent from the call kwargs.
• test_create_job_from_job_bundle_debug_snapshot_with_attachments (new) verifies the same for _snapshot_attachments on the snapshot path; it fails pre-fix with config absent.

Suite runs: test_job_bundle_submission.py (41 tests) plus the full test/unit/deadline_client/api/ + test_cli_bundle_submit*.py suites (578 passed). hatch run fmt and hatch run lint (ruff check, ruff format, mypy) pass; full CI matrix is green.

Not covered (manual-only, not automatable): executing a generated submit_job.sh/submit_job.bat against a live farm, and observing a real CreateJob whose GetJob response omits lifecycleStatusMessage. These are optional hardening checks; the mocked flows exercise the exact code paths changed.

[github-actions]

Unlike _upload_attachments (which forwards config to get_deadline_cloud_library_telemetry_client(config=config) at line 220), _snapshot_attachments never uses its config parameter — its body does not reference it, and its @record_success_fail_telemetry_event decorator calls get_deadline_cloud_library_telemetry_client() with no config. So the config=config added here is effectively dead, and the new test docstring claiming the config is "forwarded ... for telemetry" is inaccurate for the snapshot path. Either wire config into the telemetry client inside _snapshot_attachments (to match upload behavior) or drop the parameter and the corresponding test assertion to avoid implying behavior that does not exist.