fix: surface hosted review runtime failures

[CompleteDotTech]

What changed

• capture a concise redacted diagnostic for non-zero Coven Code runs
• persist the diagnostic in run and task artifacts
• include it in failed GitHub review publications while preserving COMMENT-only fail-closed behavior
• redact provider account identities and email addresses alongside existing token redaction
• verify repeated attempts receive fresh artifact directories

Root cause

Hosted reviews were failing before their first tool call because the configured Codex OAuth account returned HTTP 429. The detailed provider error existed only in run.json; the GitHub review showed downstream empty-evidence limitations, obscuring the actionable failure.

Impact

Future provider, timeout, signal, and process failures retain a useful redacted reason in server artifacts and failed review output. Incomplete review evidence still cannot produce APPROVE or REQUEST_CHANGES.

Validation

• npm test (95 passed)
• npm run build
• live OAuth model smoke: gpt-5.4-mini returned model-path-ok