fix(supervise): fail closed when a provider refuses an environment create

[drewstone]

Closes #1272.

Problem

A provider SDK throws its own error classes. So an environment create that the platform refused reaches classifyDriverFailure as neither a BackendTransportError nor an AgentEvalError, falls past every branch, and takes the foreign-accident default: transient, retry. The refusal is deterministic, so every retry reproduces it until the attempt ceiling or the deadline.

Measured 2026-09-16 on discovery-lab, runtime 0.236.0, provider tangle-sandbox. Twelve roots pressed ~20 s apart; one got a Sandbox and eleven produced exactly this and nothing more:

{"kind":"execution-admitted","admission":{"phase":"intent","provider":"tangle-sandbox", …}}
{"kind":"metered","spend":{"tokens":{"input":0,"output":0},"ms":0,"tokensKnown":false}}  ×4

root-stream.jsonl stayed 0 bytes. The coordination servers bound and answered 401 unauthenticated, so the runs looked healthy from every local angle. They sat for 25 minutes until an operator cancelled them. The platform's side of the same window: 200 rejections across about a dozen sandbox ids at 14-22 attempts each, each carrying HTTP 400 {"error":"Platform key delegation failed …","code":"CONFIG_ERROR"}. The underlying cause was budget reservation — a budgeted platform key funds one live sandbox, because the first box's router child reserves the whole remaining budget.

The status was on the error the whole time. Nothing read it.

Change

classifyDriverFailure reads a plain HTTP status off any thrown Error after the existing branches, and applies the split the transport branch already promises consumers: 408, 429 and 5xx are the upstream having a bad moment; any other 4xx is a request that will fail identically forever.

Only a thrown Error is read, and only a plain integer in 400-599 decides anything. That bound is not cosmetic: status is an ordinary field name on settlements, run states and provider-model records. The first version of this patch tested typeof error === 'object' and broke bridge-executor.test.ts — a bridge child that aborts mid-turn rejects with such a value, and classifying it as an HTTP refusal skipped the retry that journals its paid usage, turning {input: 17, output: 3} into {input: 0, output: 0}. That case is now a regression test.

Checked

• vitest run src/runtime/supervise tests/kernel — 1640 passed, 1 skipped, 0 failed.
• vitest run src/runtime/supervise/driver-retry.test.ts — 58 passed, including the new cases: a provider SDK error at 400/403/409 is terminal, at 408/429/502 transient, and a non-Error value or a non-HTTP status keeps the historical default.
• tsc --noEmit clean; biome check clean on both changed files.

What this does not fix

The refusal reaching the journal as a cause. A terminal create failure still settles driver-failed; carrying it through as retainedPendingCause: 'request-rejected' (the vocabulary from #1204/#1247) is the follow-up, and #1272 stays open for it. This PR stops the silence and the 25-minute wait.

Separately, hiding the real reason behind CONFIG_ERROR is the sandbox platform's own bug and its team owns it.

[drewstone]

Two follow-ups pushed since the first review pass:

• chore(testing): the proposal fixtures pin runtimeVersion against package.json, so the 0.237.1 bump needed pnpm run generate:testing-fixture. That was the CI failure.
• refactor(supervise): error-message.ts already had a safe HTTP-status reader, used to build the persisted failure text, and this PR had grown a second one beside it. The original is now exported and the duplicate deleted, so a failure is classified from exactly the status an operator sees quoted back to them — and a status behind a throwing getter can no longer take the classifier down, which the duplicate did not guard. Covered by a new hostile-getter case.

vitest run src/runtime/supervise: 244 passed. tsc --noEmit and biome check clean.