fix(gateway): dm catches A2AAccessDeniedError; circuit breakers handle dict errors

Smoke-7 surfaced: be-qa called dm(recipient='qa-all', ...) — 'qa-all'
is a channel slug, not an agent. A2A enforcement raised
A2AAccessDeniedError. It propagated past dm(), past content_actions,
got caught by FastAPI middleware which renders RobocoError.to_dict()
as {'error': {'code': ..., 'message': ..., 'details': ...}} — a
DICT-shaped 'error' field.

do_server's circuit-breaker check (and flow_server's mirror) did
`payload.get('error') in _CIRCUIT_REJECTION_KINDS` — trying to hash
a dict against a frozenset → `TypeError: unhashable type: 'dict'`.
The agent saw "Error executing tool dm: unhashable type: 'dict'"
and got stuck calling dm in a loop.

Two-layer fix:

1. content_actions.dm now catches A2AAccessDeniedError and returns
   Envelope.not_authorized with the original reason + route_hint as
   remediate. This is the right shape — content tools always emit
   Envelopes; RobocoErrors escaping to the middleware is a bug.

2. Defense-in-depth: do_server._record_and_check_circuit and
   flow_server._record_and_check_circuit now guard against non-string
   error fields. Any future RobocoError-leak that bypasses (1) will
   pass through untouched instead of crashing the tool call.

3 new tests pin the contracts:
- dm A2A denial returns Envelope.not_authorized (not propagated)
- do_server circuit-breaker doesn't crash on dict-shaped errors

roboco/mcp/do_server.py

@@ -130,7 +130,14 @@ def _record_and_check_circuit(
     the original payload. The breaker is a safety net; it must never
     break the gateway path.
     """
+    # Gateway envelopes use a string `error` (kind); RobocoError-derived
+    # exceptions surface a dict-shaped error via FastAPI's middleware
+    # (smoke-7: TypeError on `dict in frozenset`). Defend against the
+    # dict shape — only string kinds count toward the breaker, dicts pass
+    # straight through.
     rejection_kind = payload.get("error")
+    if not isinstance(rejection_kind, str):
+        return payload
     if rejection_kind not in _CIRCUIT_REJECTION_KINDS:
         return payload