feat(analytics): classify WriteError hierarchy out of unknown

[awkoy]

Summary

• The gap: write tool failures all landed in error_kind=unknown in BI. Every WriteError subclass (validation, backend, auth-denied, batch limits, unknown-op) was missing from _ERROR_KIND_TABLE in analytics/wrappers.py.
• The reason tool_args_invalid didn't catch it: writes/dispatch.py catches pydantic.ValidationError at every op.pydantic_model.model_validate(...) call and re-raises as ValidationFailedError, which extends Exception directly (not pydantic.ValidationError). So the pydantic row in the table never fired on the write path.
• The fix: add the 6 WriteError subclasses to the classifier (subclass-before-parent ordering preserved) plus a WriteError catch-all row. Bucket names mirror the stable ErrorCode literals already declared in writes/errors.py so BI dashboards can join the analytics event against the tool-result envelope by the same enum.

This is a direct follow-up to PR #118 — discovered while verifying that 0.1.3 actually shrinks the 44% unknown share. Triggered 6 real failure paths through live MCP tool calls; 3 of them (every write-tool path) were misrouted to unknown.

Test plan

• make check clean — 508 tests pass, ruff format clean, mypy strict clean
• 8 new parametrized cases in test_analytics_wrappers.py cover every WriteError subclass + the catch-all row
• Existing tool_args_invalid row preserved with updated comment explaining why it doesn't fire on the write path
• After merge: re-run the same 6-case verification and confirm write failures now route to write_validation_failed / write_backend_error instead of unknown

🤖 Generated with Claude Code