Complete token error sanitization across agent containers

[Brandon Werner (brandwe)]

Summary

• adds sanitize_token_error to every deployable service-local token exchange module
• sanitizes the two remaining direct A2A response paths
• adds a contract test that keeps service copies byte-for-byte synchronized with src/shared
• rejects client-facing detail fields that call get_last_token_error() directly
• runs the token-exchange provider tests in CI
• documents test-first TDD as a repository requirement

TDD sequence

1. Added the regression contract test.
2. Confirmed it failed on raw token errors in budget-report/app.py and budget-approval/app.py.
3. Applied the minimal response sanitization fix.
4. Confirmed the same test passed.

Local checks

• python3 -m unittest src/test_token_error_contract.py -v
• python3 -m compileall -q src
• bash -n deploy.sh
• git diff --check

Closes #24