fix(safe-read): keep refusal output metadata-only

[andrei-hasna]

Summary

• keep contracts read refusal reasons and evidence metadata-only
• retain exit codes, captured byte counts, and failed-check classifications
• cover nonzero target failures and widening failures in human and JSON modes

Verification

• focused regression: 57 pass, 0 fail, 250 assertions
• full suite: 1423 pass, 7 skip, 0 fail, 14069 assertions across 62 files
• typecheck: tsc --noEmit, exit 0
• build: exit 0; generated artifacts current
• staged secrets scan: exit 0, 4 files, 149617 bytes, 0 findings
• live synthetic controls: sentinel absent from all wrapper stdout/stderr; exit code, byte count, and failed-check metadata retained

Scope

Remediation cycle 1 for Todos task 63fa16ee-09d0-486e-9733-aa8f84d64e3f. Merge and publishing remain stopped pending the fixed review and release gate.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #104 @ 01072c7 — lens: correctness+security+gates, reviewer unresolved-account002 (1 of 1)

Reviewed the exact diff from freshly fetched base b31f860 to head 01072c7.

What I read:

• Full diffs for CHANGELOG.md, src/safe-read.ts, src/safe-read-exec.ts, and tests/safe-read.test.ts.
• Surrounding classifier, subprocess capture, pagination/widening, refusal construction, and src/cli/read.ts human and JSON rendering paths.
• The regression coverage for direct nonzero exits, exit-0 error objects, failed widening probes, and both CLI output modes.

Commands and measured results:

• bun install — exit 0; setup only, 23 packages installed; pass/fail counts not applicable.
• bun run typecheck — exit 0; tsc --noEmit emitted no diagnostic counts; 0 reported errors.
• bun run test — exit 0; 1423 pass, 0 fail, 7 skip, 14069 expect() calls, 1430 tests across 62 files.

Blocking P0/P1 findings: none.

The changed paths keep refusals fail-closed and preserve their diagnostic code and exit metadata without reproducing child stderr, parse details, or error-object payloads. The end-to-end tests exercise both human and JSON refusal renderers and the widening fallback.

Non-blocking follow-ups: none.