fix(metadata-protocol): withhold caught driver text from the batch verbs' response payloads (#8333) (#8436)

* fix(metadata-protocol): withhold caught driver text from the batch verbs' response payloads (#8333)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012WMpuAfA2KSdDjGF6tm1bH

* test(metadata-protocol,objectql): pin the batch verbs' withhold and its authoring-feedback bound (#8333)

Adds protocol.batch-verb-driver-text.test.ts: the eight P6-P13 reproductions,
the [GUARD] over-block bounds, the mandatory positive control (a real broken-CEL
approval flow still names the offending field on publish), P9's producer-side
declaration, and the operator half (the withheld line still reaches the log).

Two objectql fixtures pinned pre-#8333 behaviour and are re-judged individually:
the all-or-nothing publish double threw a `code` with no `status`, which the
real producer never does (ITEM_LOCKED is 403) - declaration added; the throwing
materializer's response-shape test keeps its shape assertion and takes the
withheld string, since a bare plugin throw is indistinguishable from driver text.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012WMpuAfA2KSdDjGF6tm1bH

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

.changeset/metadata-protocol-batch-verb-driver-text.md

@@ -0,0 +1,33 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+Stop putting caught driver text on the batch verbs' response payloads (#8333).
+
+`publishPackageDrafts`, the publish side effects and their materializer, the seed
+apply, `duplicatePackage`, `revertCommit`, `rollbackToPackageCommit` and
+`migrateStoredMetadata` each reported a failure by copying the caught error's
+sentence onto a field of the response — `failed[].error`, `materializeApplied`'s
+`failures[].error`, `seedApplied.error`, `rows[].reason`. Those are DATA, not
+messages, so no HTTP boundary's 5xx message withhold ever reached them: a
+`sys_metadata` outage shipped `SQLITE_ERROR: no such table: sys_metadata` to the
+client on an otherwise successful-looking response.
+
+All eight now follow the rule #8136 installed for the uninstall cluster: a caught
+sentence is quoted back only when that error **declared itself a client-facing
+refusal** (a 4xx `status` in the ADR-0112 envelope). Anything else gets a stable
+sentence and the original goes to the server log, which these sites did not
+previously write at all.
+
+Authoring feedback is unaffected, and that was measured before anything changed
+rather than assumed. Every authored refusal reaching these collectors already
+declares 4xx, so it is still quoted verbatim — a failed package publish still
+tells the author which field of which draft is wrong, with its `code` and
+structured `issues` intact.
+
+One producer needed declaring rather than converting: `applySeedBodies` parsed
+the seed request with `SeedLoaderRequestSchema.parse()`, so a malformed seed body
+surfaced as a raw `ZodError` that declared nothing. It is now a `safeParse` that
+raises a real `422 INVALID_METADATA` envelope, so `seedApplied.error` carries the
+same curated, path-pointing summary every other authoring surface produces
+instead of a multi-line dump of zod internals.