fix(gateway): dm catches A2AAccessDeniedError; circuit breakers handle dict errors

Smoke-7 surfaced: be-qa called dm(recipient='qa-all', ...) — 'qa-all'
is a channel slug, not an agent. A2A enforcement raised
A2AAccessDeniedError. It propagated past dm(), past content_actions,
got caught by FastAPI middleware which renders RobocoError.to_dict()
as {'error': {'code': ..., 'message': ..., 'details': ...}} — a
DICT-shaped 'error' field.

do_server's circuit-breaker check (and flow_server's mirror) did
`payload.get('error') in _CIRCUIT_REJECTION_KINDS` — trying to hash
a dict against a frozenset → `TypeError: unhashable type: 'dict'`.
The agent saw "Error executing tool dm: unhashable type: 'dict'"
and got stuck calling dm in a loop.

Two-layer fix:

1. content_actions.dm now catches A2AAccessDeniedError and returns
   Envelope.not_authorized with the original reason + route_hint as
   remediate. This is the right shape — content tools always emit
   Envelopes; RobocoErrors escaping to the middleware is a bug.

2. Defense-in-depth: do_server._record_and_check_circuit and
   flow_server._record_and_check_circuit now guard against non-string
   error fields. Any future RobocoError-leak that bypasses (1) will
   pass through untouched instead of crashing the tool call.

3 new tests pin the contracts:
- dm A2A denial returns Envelope.not_authorized (not propagated)
- do_server circuit-breaker doesn't crash on dict-shaped errors

tests/unit/mcp_servers/test_do_server_circuit_breaker.py

@@ -260,3 +260,30 @@ def test_verb_extracted_from_path(do_module: types.ModuleType) -> None:
         do_module.commit(message="[abc12345] test commit message under 20 chars")
     sdk_body = next(body for url, body in captured if "test-sdk" in url)
     assert sdk_body["verb"] == "commit"
+
+
+def test_dict_shaped_error_does_not_crash(do_module: types.ModuleType) -> None:
+    """A RobocoError.to_dict()-shaped response must pass through without TypeError.
+
+    Smoke-7: A2AAccessDeniedError escaped to middleware and was rendered as
+    {'error': {'code': ..., 'message': ..., 'details': ...}}. The circuit
+    breaker's `error in frozenset` check then crashed with
+    `TypeError: unhashable type: 'dict'`.
+    """
+    factory, captured = _make_client(
+        orchestrator_response={
+            "error": {
+                "code": "A2A_ACCESS_DENIED",
+                "message": "be-qa cannot A2A with qa-all",
+                "details": {},
+            }
+        },
+        sdk_response=None,  # SDK must not be touched
+    )
+    # No TypeError; payload passes through untouched.
+    with patch("httpx.Client", side_effect=factory):
+        result = do_module.dm(recipient="qa-all", text="x")
+    assert isinstance(result["error"], dict)
+    assert result["error"]["code"] == "A2A_ACCESS_DENIED"
+    # SDK breaker MUST NOT have been called for a non-string error.
+    assert all("test-sdk" not in url for url, _ in captured)