Classify provider 403 responses as auth errors

[ktwu01]

Summary

Classifies provider HTTP 403 responses as provider.auth_error instead of provider.api_error when serializing errors across the agent boundary.

This covers the client-side part of #636: an upstream access_terminated / forbidden response should be surfaced as an auth or access problem, not as a generic provider failure. The server-side platform allowlist issue still needs to be handled separately by Moonshot.

Validation

• pnpm vitest run packages/agent-core/test/errors/serialize.test.ts
• pnpm vitest run packages/agent-core/test/agent/turn.test.ts -t "403 status"

Refs #636.

[changeset-bot]

⚠️ No Changeset found

Latest commit: d385ecc

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR