feat(acp): add stable error_class to turn_error observer events

[Bartok9]

Refs #1659

Problem

Agent turn failures are emitted to the observer feed as undifferentiated turn_error events carrying only outcome + an error string. As #1659 notes, the harness boundary (handle_prompt_result in crates/buzz-acp/src/lib.rs) doesn't include a class field, so every failure type arrives at the UI as the same thing — and the UI collapses it to a transient "Turn error" that disappears before a human can act on it. Operators can't tell an idle timeout from a dead process from a provider/application error.

Why it matters

Agents are first-class citizens in Buzz; when an agent turn fails, humans and other agents need to know how it failed to react correctly (retry vs. wait vs. fix credentials vs. report a crash). A stable, machine-readable class is the minimum needed for the UI (and other observers) to persist a differentiated, actionable badge.

What this changes (harness boundary — seam #1 of #1659)

Threads a machine-readable error_class onto every turn_error observer payload:

Outcome	error_class
AgentExited	exited
Timeout(Idle)	idle_timeout
Timeout(Hard)	hard_timeout
CancelDrainTimeout	cancel_drain_timeout
transport/protocol Error (Io/WriteTimeout/Timeout/Protocol)	transport_error
application Error (pipe intact)	application_error
task panic (agent_panic event)	panic

The fatal-death classes reuse the existing outcome_label taxonomy; the two Error sub-branches already distinguish transport vs application for respawn decisions, so this just surfaces that same distinction to observers.

Additive / no breaking changes

Existing outcome, error, and code fields are unchanged and still emitted. error_class is a new key alongside them. This means the UI-store fix (seam #2, activeAgentTurnsStore.ts) can consume error_class in a decoupled follow-up PR without depending on this one's timing.

How to test

cargo test -p buzz-acp error_outcome_emission   # 16 passed (incl. new test)
cargo fmt -p buzz-acp --check
cargo clippy -p buzz-acp

New regression test turn_error_carries_stable_error_class asserts the emitted class per outcome (exited, idle_timeout). The existing "exactly one feed event" tests still pass, confirming no double-emit or dropped-emit regressions.

Observability / security notes

• Purely additive to an existing observer event; no new surface, no new unsafe (crate is #![deny(unsafe_code)]).
• error_class is a fixed enum of static strings — no user/agent-controlled data flows into the class value, so it's safe to branch on in the UI.
• Error message content is unchanged (same redaction/handling as before).

Signed-off-by DCO.

---

Context: this mirrors a classified-failure/observability pattern we've used elsewhere — never collapse distinct failure modes into one transient signal. Happy to take the UI-store persistence half in a follow-up PR if you'd like to keep PRs one-seam-each.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 3c7f288c60d67df78577b237e27c3dfc8831aaa1...f819659b39fb6a17918304721b35c430949ca74f.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review f819659b39fb6a17918304721b35c430949ca74f to authorize a new review.
Any previous review applies only to its recorded range.