fix(telemetry): surface AI sidecar and DOMException failure reasons in Sentry (#612)

AI sidecar failures reached Sentry as 'Error: Error': the scrubber type-onlys plain Errors and the tool wrappers threw them from result.error. The bridge now exports toSidecarError(), wrapping the sidecar reason in a SafeError (memory-allocation text classifies as operational, the rest as bug); all 14 wrappers use it, plus the dispatcher crash/stdin/spawn rejection paths and parseStdoutJson. toBgRemovalError from #535 delegates to the shared helper.

On the web side, DOMExceptions report their specific name via err.name, so the NATIVE_ERRORS allowlist dropped the whole family's browser-authored messages. It now carries the full WebIDL DOMException name table; messages still pass through url/path redaction.

Bridge-mocking test files switched to importOriginal passthrough mocks.

apps/web/src/lib/sentry-scrub.ts

@@ -36,10 +36,41 @@ const NATIVE_ERRORS = new Set([
   "SyntaxError",
   "ReferenceError",
   "DOMException",
-  "SecurityError",
-  "NotSupportedError",
-  "QuotaExceededError",
+  // DOMExceptions report their specific name via err.name, not "DOMException",
+  // so the base entry alone dropped the diagnostic browser message for the
+  // whole family (WEB-3/4/6 arrived as "NotFoundError: NotFoundError"). This is
+  // the full WebIDL DOMException name table: every message is browser-authored
+  // and still passes through scrubText's url/path redaction.
   "AbortError",
+  "ConstraintError",
+  "DataCloneError",
+  "DataError",
+  "EncodingError",
+  "HierarchyRequestError",
+  "IndexSizeError",
+  "InUseAttributeError",
+  "InvalidAccessError",
+  "InvalidCharacterError",
+  "InvalidModificationError",
+  "InvalidNodeTypeError",
+  "InvalidStateError",
+  "NamespaceError",
+  "NetworkError",
+  "NoModificationAllowedError",
+  "NotAllowedError",
+  "NotFoundError",
+  "NotReadableError",
+  "NotSupportedError",
+  "OperationError",
+  "QuotaExceededError",
+  "ReadOnlyError",
+  "SecurityError",
+  "TimeoutError",
+  "TransactionInactiveError",
+  "UnknownError",
+  "URLMismatchError",
+  "VersionError",
+  "WrongDocumentError",
 ]);
 
 // Per-session runaway guard (Sentry de-dupes by fingerprint server-side, so 500