…rations

Defines the CLI error actionability taxonomy for KPI reporting (CLI-1560):
error kinds, categories, suggestion types, and the Q2 strict-recovery /
repeat-error / internal-unknown-rate metric definitions.

Classification is declared where each error is defined: every error class in
apps/cli exposes a CliErrorActionabilityDeclaration under the
ErrorActionabilityId symbol, enforced by an exhaustiveness test that fails
when any error class lacks a declaration. Errors from workspace packages
(stack, config, process-compose) and effect cli/http are classified by a
small structural adapter, exhaustiveness-checked against those packages'
sources.

Broad wrapper errors gain structured discriminants instead of message
sniffing: StackBuildError.reason, DockerPullError.daemonDown,
LegacyDockerRunError.reason/daemonDown, and a typed upgradeSuggested prop
threaded from legacySuggestUpgrade through the plan-gated sso, branches, and
vanity-subdomains errors.

No telemetry capture changes: cli_command_executed still emits only existing
fields until CLI-1561 wires classification into failure events.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Coverage: the drift guard now also enforces declarations on plain
`extends Error` classes, and the external adapters cover the full effect
cli parser error set (MissingArgument, DuplicateOption, InvalidValue),
UserError unwrapping, and PlatformError/BadArgument with reason-based
classification.

Classification fixes from a construction-site audit of all ~420 classes:
local filesystem failures mislabeled as config/input errors now classify
as permission; CLI-internal declarative script failures move to
internal_bug; transport failures conflated with user errors in
LegacyDbQueryExecError, LegacyDeclarativeApplyError, and
LegacyDomainsCnameError are split via typed discriminants; paused
projects get the new open_dashboard suggestion type; and
LegacyDbConfigIpv6Error's suggestion now matches the link command the
CLI actually prints.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- Coverage scan now recognizes any local `*Error("Tag")` factory (e.g. the
  next login shell's LoginError), closing the drift-guard gap for NoTtyError
  and LoginFailedError, which now declare auth classifications.
- classifyCliErrorActionability recurses into a StackError's preserved
  tagged cause before falling back, and uses own-property adapter lookups so
  sanitized tags like "constructor" cannot hit Object.prototype.
- DockerPullError.daemonDown now also covers docker spawn failures (binary
  missing), not just daemon-down output.
- DeleteFunctionUnexpectedStatusError, LegacyDbQueryUnexpectedStatusError,
  and LegacyLinkAuthTokenError thread the response status and classify via
  statusCodeActionability, so 401s land in auth and 5xx in api_status.
- Paused projects get a dedicated project_paused category instead of
  polluting plan_limit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ures

- classifyCliErrorActionability recurses into the classifiable preserved
  cause of stack wrapper errors (asset-preparation StackBuildError,
  DownloadError, StackError), so a daemon-down DockerPullError or a local
  filesystem PlatformError is no longer reported as a registry/network
  failure. Recursion is guarded: an unclassifiable cause keeps the
  wrapper's own bucket.
- statusCodeActionability and the HttpClientError adapter classify 403 as
  user-actionable account permission (after the entitlement-gate branch, so
  confirmed plan gates stay plan_limit).
- packages/api joins the adapter coverage scan; SupabaseApiConfigError
  classifies as auth/set_env_var.
- LegacyStorageAuthTokenError branches on its stored status like its link
  twin, so api-keys 5xx responses stop counting as user login problems.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>