Show actionable provider error links

[mrubens]

Summary

• preserve actionable links in human-readable provider error messages
• continue redacting secrets and rejecting raw JSON or header diagnostics
• add regression coverage for a non-retryable region opt-in error

Root cause

The terminal provider-error formatter treated any message containing an HTTP URL as unsafe. That discarded otherwise useful provider guidance and caused the task UI to show only the generic fallback.

Impact

The existing provider-error card can now show the provider's specific explanation and action link while the diagnostic payload remains excluded.

Validation

• pnpm exec dotenvx run -f .env.test -- pnpm --filter @roomote/worker exec vitest run src/sandbox-server/lib/harnesses/__tests__/opencode-server.test.ts
• pnpm --filter @roomote/worker check-types
• pnpm --filter @roomote/worker lint
• pre-push Oxlint, residual lint, fast typechecks, and Knip

[roomote-community]

1 issue outstanding. See task

• apps/worker/src/sandbox-server/lib/harnesses/opencode-server/harness.ts:1058 Allowing all URLs exposes credential-bearing URLs in the persisted error summary. redactSecrets does not remove URL user-info (https://user:password@...) or signed query values such as signature=..., so provider diagnostics containing either are now written to the transcript. Strip URL credentials/query parameters or preserve only a URL form that is known not to contain credentials.

_{Reviewed ea68b67}