fix(sse): surface Adapta non-stream SSE errors

[diegosouzapw]

Summary

• Detect Adapta Web type:error events inside successful HTTP 200 SSE responses when the caller requested stream: false.
• Return a real HTTP 502 OpenAI-compatible failure instead of an empty assistant completion with HTTP 200.
• Keep the public message generic through buildErrorBody, so upstream diagnostics, paths, credentials, and stack material do not cross the response boundary.
• Stop collecting and cancel the upstream reader after the terminal error while preserving normal non-stream text assembly.
• Run the environment/DB-dependent integration in a dedicated subprocess so it cannot replace another unit test's DATA_DIR, plugin directory, fetch hook, or DB singleton.

Behavior

Scenario	Before	After
HTTP 200 SSE with type:error	HTTP 200 empty assistant completion	HTTP 502 server_error / bad_gateway
Hostile upstream errorText	Sanitized-but-private diagnostic could remain visible	Fixed public message: Adapta upstream error
Normal text-delta sequence	HTTP 200 completion	Unchanged HTTP 200 completion
Adapta test loaded beside DB/call-log tests	Replaced process-wide DATA_DIR and reset the shared DB	Parent stays pure; stateful cases execute in an isolated child

Validation

Candidate SHA: 23434779ef41db82dd68f735974cf89ac4164a0d
Candidate tree: 79234912cfe96841d7af21fe25ac2934436fa815

Check	Result	Evidence
Original functional bug fixture	PASS	RED (200 !== 502) → GREEN
Private-diagnostic boundary fixture	PASS	RED (SQLSTATE/private detail remained) → GREEN (generic message only)
Isolation reproduction	RED proven	Normal paired runs could pass while opening call-log SQLite under omniroute-adapta-nonstream-error-*, proving silent cross-test state capture. A deterministic call-log-first import probe failed 3/4 at the artifact assertion (false !== true) after Adapta replaced DATA_DIR
Cross-suite isolation regression	PASS	Absolute call-log-save-drain + Adapta wrapper under --test-isolation=none: 3/3; DB remained under omniroute-call-log-drain-*
Focused Adapta boundary fixture	PASS	2/2 in an env -i child; all 13 original assertions preserved
Existing Adapta executor regressions	PASS	5/5
Child secret hygiene	PASS	No ...process.env, no HOME, no ambient provider/session credentials; explicit runtime allowlist, synthetic API_KEY_SECRET, child-local temporary data/plugin directories, inherited NODE_TEST_CONTEXT removed
Core TypeScript	PASS	exit 0
Open-SSE typecheck gate	PASS	openSseTypecheckErrors=0
Focused ESLint	PASS	Repository suppressions, no findings
Prettier / diff check	PASS	All four owned files formatted; git diff --check clean
Changelog integrity	PASS	No base bullets lost after reconciling the live release
Independent material review	PASS	Production file and changelog remain byte-identical to the previously reviewed zero-P1/high/material-P2 snapshot
Live release reconciliation	PASS	Merged base e243b04de22da2d78900c27fde5f83f4fbc3d7f9; no owned-path overlap; merge commit 23434779ef41db82dd68f735974cf89ac4164a0d
GitHub CI	HOLD	Awaiting checks on candidate 23434779ef41db82dd68f735974cf89ac4164a0d
Live provider validation	HOLD	Intentionally not run: requires live identity/session credentials; all HTTP paths use deterministic stubbed transports

No live provider request or real credential was used.

Scope

• changelog.d/fixes/adapta-nonstream-sse-error.md
• open-sse/executors/adapta-web.ts
• tests/fixtures/adapta-web-nonstream-error-boundary.fixture.ts
• tests/unit/adapta-web-nonstream-error-boundary.test.ts