fix(dsh): handle Scope failures at tool and command boundaries

[knqiufan]

Which issue or RFC does this PR close?

Closes #1451.

Refs #1450 (work package A).

Rationale for this change

Scope resolution currently runs outside the error boundary used for DSH HTTP operations. A failed resolver request can therefore escape as a host exception from a named tool or block /pc doctor before its health checks run. Operation-level 404 results also discard the public reason, making a missing Scope or Memory difficult to distinguish from an unavailable required route.

What changes are included in this PR?

• Catch failures across Scope resolution and direct operation execution, and report them through the existing bounded diagnostics mechanism. Diagnostic writer exceptions and rejected callbacks do not replace the operation result.
• Preserve not_found for business 404s and add optional error_code for recognized public reasons. A 404 becomes version_mismatch only when the original business code is absent and the endpoint is required, including Scope resolution. Keep the existing authentication, availability, conflict, and validation codes, and map detected invalid responses explicitly.
• Replace Server-provided failure messages with fixed text and omit unrecognized error codes from results and diagnostics.
• Dispatch doctor, capabilities, and local usage before Scope resolution. Keep bare status usable with scope=unresolved, controlled error details, a recovery hint, and a redacted Server origin.
• Pass the direct caller's cancellation signal through Scope resolution and stop cancelled calls before subsequent business dispatch. Retain the existing per-request timeout and Server-owned Scope selection rules.
• Add registered-tool/command regression coverage and a live-Server test for a nonexistent explicit Scope, retain default-Scope coverage, update both DSH guides, and rebuild the checked-in bundle.

The implementation builds on #1401, #1360, and #1371. It leaves the transport/encoding work in #1438 and Scope onboarding in #1449 to their existing owners. Automatic-hook diagnostics, broader Doctor probes, and guidance/status work remain in #1450 B–F.

Are there any user-facing changes?

Yes. Scope failures return controlled failures instead of escaping to DSH. Doctor and capabilities work independently of Scope availability; usage help is local. Bare /pc reports an unresolved Scope honestly and displays only the Server origin.

Failure results retain available status and request_id; business 404s can additionally expose a safe error_code. Existing success results and specific public 409/422 codes remain compatible. Failed Scope resolution does not write Memory, create bindings, or select another Scope. No HTTP API contract or persisted-format change is required.

How was this change tested?

The initial registered-entry regression suite reproduced the defect on the base revision: 24 failures and 3 passes. The completed suite passes.

GNU make is unavailable on the local Windows host, so the Makefile recipes were executed directly in PowerShell:

• make js-test recipe: frozen pnpm installation, unit tests, build, generated-operation/bundle git diff --exit-code, unit tests again, and live-Server e2e — 117 unit tests and 9 e2e tests passed, with no generated-output drift.
• make check recipe: generated integration-manifest documentation check, 26 integration-manifest tests, uv lock --locked, uv run prek run -a, uv run ty check, and the Pydantic AI integration type check — passed.
• make docs-test recipe: strict clean Zensical build with the canonical OpenAPI copy, API-page existence check, and published-contract byte equivalence — passed.
• git diff --cached --check — passed.

Regression coverage includes resolver and operation failures, required-route versus business 404s, authentication, timeout, cancellation, unresolved Scope, safe error output, diagnostic writer failures and cooldown, Scope-independent commands, and exact-Scope stats. The live-Server case verifies that a nonexistent explicit Scope fails direct operations while doctor/capabilities remain usable.

Upstream CI also passed dsh-package (make js-test), quality (make check and make contract-test), check-docs (make docs-test), and the license-header check on commit c776cddf.

AI usage statement

OpenAI Codex assisted with investigation, implementation, regression tests, documentation, and validation.