Preserve deployment failures and redact command error output #2665

Parent: #2168. Implementation: #2626.

This bounded issue covers deployment-handoff exception and error-result behavior, leaving the broader exception-cleanup parent open.

Acceptance:

• Redact configured credentials from exception tracebacks and ordinary nonzero CLI stderr/stdout error results.
• Classify expected URL, HTTP, filesystem and subprocess failures without swallowing unrelated programming errors.
• Keep usable GitHub/partial artifacts when a later Vercel step fails, while reporting the requested deployment stage as failed.
• Keep tests isolated from ambient database configuration.
• Verify the combined result using the actual stage classifier from fix(agents): report unimplemented MCP routes as failures and fail closed on VERA errors #2628 with all provider actions mocked; GitHub success plus Vercel failure must not report pipeline success.

Negative controls and passing regression commands are recorded in #2626. No live deployment is required or authorized by this issue; it closes only after the bounded PR is merged through the existing gates.