fix(agent-backend): surface parsed CLI exit reasons in cause chains

[berenddeboer]

Operators were seeing a bare AgentBackendExitError with no text and no
exit code, even when Claude, Codex, or Grok had already parsed a
human-readable failure. Inspect copy degraded to "Agent Backend
inspection failed (AgentBackendExitError)". This is the diagnostics
half of #1056; stderr capture for turns remains #1057.

AgentBackendExitError now accepts an optional message (transitional
until #1066). It is sanitized on construction (ANSI stripped,
token-shaped secrets redacted, length bounded). Claude is_error,
Codex turn.failed, and Grok stream error / max-turns populate it.
runCliCapture uses captured stdout/stderr. Cause-chain links derive
code from exitCode so the disclosure can render
AgentBackendExitError 1 — <reason>. Codex inspect failures raise the
exit error with probe text instead of wrapping a ConfigError
workaround; formatInspectFailure already prefers error.message.

Review follow-up: a parsed stream reason now rides on runCliTurn the
same way errorClassification does, so a CLI that emits JSONL then
exits non-zero no longer drops the reason. Tests cover that path with
exit 1 after the error event.

Verified with agent-backend, Claude, Codex, Grok, github-service
cause-chain, and install-dependencies fallback specs. Deferred:
duplicate sanitizer regexes stay package-local (layering); the nested
TypeScript-7 Nx symlink script is a local hook-layout fix, not product
behaviour.

Closes #1056

[berenddeboer]

Pushed 2d064967dcbc2a0b7df7f2baa5e32db6dd042818 to fix the red quality-gates and harness-e2e-live-forge jobs.

Change: AgentBackendExitError no longer overrides the Schema constructor (TS377044 / effect(overriddenSchemaConstructor)). Sanitization now lives on static AgentBackendExitError.new, and call sites construct through that factory.

Verification: nx run agent-backend:build, nx run agent-backend:typecheck, and the exit-message / runCliCapture / runCliTurn specs passed. Pre-commit nx affected -t lint,typecheck,test passed on commit.

Review feedback addressed: none from Automated Review — this addresses the CI typecheck/build failure only.

Review feedback declined: none.

[berenddeboer]

Pushed cb958a01e65eac062597f68af2a896296a5edd26 to fix the red quality-gates job.

Change: Stop exporting AGENT_BACKEND_EXIT_MESSAGE_MAX. The length bound stays private in the sanitizer; knip no longer reports an unused export.

Verification: nx run agent-backend:knip passed. Pre-commit nx affected -t lint,typecheck,test passed on commit.

Review feedback addressed: none from Automated Review — this addresses the CI knip failure only.

Review feedback declined: none.