fix(gateway): dm catches A2AAccessDeniedError; circuit breakers handle dict errors

Smoke-7 surfaced: be-qa called dm(recipient='qa-all', ...) — 'qa-all'
is a channel slug, not an agent. A2A enforcement raised
A2AAccessDeniedError. It propagated past dm(), past content_actions,
got caught by FastAPI middleware which renders RobocoError.to_dict()
as {'error': {'code': ..., 'message': ..., 'details': ...}} — a
DICT-shaped 'error' field.

do_server's circuit-breaker check (and flow_server's mirror) did
`payload.get('error') in _CIRCUIT_REJECTION_KINDS` — trying to hash
a dict against a frozenset → `TypeError: unhashable type: 'dict'`.
The agent saw "Error executing tool dm: unhashable type: 'dict'"
and got stuck calling dm in a loop.

Two-layer fix:

1. content_actions.dm now catches A2AAccessDeniedError and returns
   Envelope.not_authorized with the original reason + route_hint as
   remediate. This is the right shape — content tools always emit
   Envelopes; RobocoErrors escaping to the middleware is a bug.

2. Defense-in-depth: do_server._record_and_check_circuit and
   flow_server._record_and_check_circuit now guard against non-string
   error fields. Any future RobocoError-leak that bypasses (1) will
   pass through untouched instead of crashing the tool call.

3 new tests pin the contracts:
- dm A2A denial returns Envelope.not_authorized (not propagated)
- do_server circuit-breaker doesn't crash on dict-shaped errors

tests/unit/gateway/test_dm_a2a_denied.py

@@ -0,0 +1,79 @@
+"""Smoke-7: dm catches A2AAccessDeniedError as Envelope.not_authorized.
+
+Original bug: be-qa called dm(recipient='qa-all', ...) — 'qa-all' is a
+channel slug, not an agent slug. A2A enforcement raised
+A2AAccessDeniedError. It propagated past dm(), past content_actions,
+and got caught by FastAPI's middleware which renders RobocoError.to_dict()
+as `{'error': {'code': ..., 'message': ..., 'details': ...}}`.
+
+do_server's circuit-breaker check then did
+`dict_error in _CIRCUIT_REJECTION_KINDS` and crashed with
+`TypeError: unhashable type: 'dict'`. The agent saw a generic
+"Error executing tool dm: unhashable type: 'dict'" and got stuck.
+
+The do_server defense-in-depth test lives in
+tests/unit/mcp_servers/test_do_server_circuit_breaker.py.
+"""
+
+from __future__ import annotations
+
+from unittest.mock import AsyncMock, MagicMock
+from uuid import uuid4
+
+import pytest
+from roboco.enforcement.a2a_access import A2AAccessDeniedError
+from roboco.services.gateway.content_actions import ContentActions, ContentActionsDeps
+
+
+def _make_deps(**overrides: object) -> ContentActionsDeps:
+    base: dict[str, object] = {
+        "task": AsyncMock(),
+        "git": AsyncMock(),
+        "messaging": AsyncMock(),
+        "a2a": AsyncMock(),
+        "journal": AsyncMock(),
+        "workspace": AsyncMock(),
+        "notifications": AsyncMock(),
+    }
+    base.update(overrides)
+    return ContentActionsDeps(**base)
+
+
+@pytest.mark.asyncio
+async def test_dm_a2a_denied_returns_envelope_not_authorized() -> None:
+    """A2AAccessDeniedError is caught and returned as Envelope.not_authorized."""
+    agent_id = uuid4()
+    task_id = uuid4()
+    task_obj = MagicMock(id=task_id, status="in_progress", assigned_to=agent_id)
+
+    task_svc = AsyncMock()
+    task_svc.agent_for.return_value = MagicMock(role="qa")
+    task_svc.get_journal_context_task_for_agent.return_value = task_obj
+    task_svc.get_active_task_for_agent.return_value = task_obj
+    task_svc.get.return_value = task_obj
+
+    a2a_svc = AsyncMock()
+    a2a_svc.send.side_effect = A2AAccessDeniedError(
+        from_agent="be-qa",
+        to_agent="qa-all",
+        reason="Cannot A2A unknown. Route: be-qa → be-pm → main-pm.",
+        route_hint="be-qa → be-pm → main-pm",
+    )
+
+    deps = _make_deps(task=task_svc, a2a=a2a_svc)
+    actions = ContentActions(deps)
+
+    env = await actions.dm(
+        agent_id=agent_id,
+        recipient="qa-all",
+        text="PASS notice",
+        task_id=task_id,
+    )
+
+    assert env.error == "not_authorized", (
+        f"A2A denial must surface as not_authorized envelope, got {env.error!r}. "
+        "If it escapes to FastAPI middleware, RobocoError.to_dict() renders the "
+        "error as a dict and the do_server circuit breaker crashes."
+    )
+    assert "be-qa" in env.message
+    assert env.remediate is not None

tests/unit/mcp_servers/test_do_server_circuit_breaker.py

@@ -260,3 +260,30 @@ def test_verb_extracted_from_path(do_module: types.ModuleType) -> None:
         do_module.commit(message="[abc12345] test commit message under 20 chars")
     sdk_body = next(body for url, body in captured if "test-sdk" in url)
     assert sdk_body["verb"] == "commit"
+
+
+def test_dict_shaped_error_does_not_crash(do_module: types.ModuleType) -> None:
+    """A RobocoError.to_dict()-shaped response must pass through without TypeError.
+
+    Smoke-7: A2AAccessDeniedError escaped to middleware and was rendered as
+    {'error': {'code': ..., 'message': ..., 'details': ...}}. The circuit
+    breaker's `error in frozenset` check then crashed with
+    `TypeError: unhashable type: 'dict'`.
+    """
+    factory, captured = _make_client(
+        orchestrator_response={
+            "error": {
+                "code": "A2A_ACCESS_DENIED",
+                "message": "be-qa cannot A2A with qa-all",
+                "details": {},
+            }
+        },
+        sdk_response=None,  # SDK must not be touched
+    )
+    # No TypeError; payload passes through untouched.
+    with patch("httpx.Client", side_effect=factory):
+        result = do_module.dm(recipient="qa-all", text="x")
+    assert isinstance(result["error"], dict)
+    assert result["error"]["code"] == "A2A_ACCESS_DENIED"
+    # SDK breaker MUST NOT have been called for a non-string error.
+    assert all("test-sdk" not in url for url, _ in captured)