refactor(trigger-api,spec)!: trigger-api answers in the declared envelope; draw the catalog's boundary (ADR-0112 batch 2)

The API-trigger webhook endpoint returned `{ error: '<code>' }` — a bare code in
the message slot, six times, three of them with no message at all. It now answers
`{ success: false, error: { code, message } }` with catalog codes
(RESOURCE_NOT_FOUND, INVALID_REQUEST, SERVICE_UNAVAILABLE) plus two registered
ones (INVALID_SIGNATURE, ENQUEUE_FAILED). Every branch gains the message it was
missing.

Also records what batch 2 decided NOT to sweep, as ADR-0112 D6c, because three
lowercase clusters look like stragglers and are not:

- Diagnostics records (`build-probes.ts` RuntimeBuildIssue,
  `metadata-diagnostics.ts`) ship as the payload of a 200, describe an artifact
  rather than the request, and carry a severity that can be 'warning'.
- Param/field-addressed issues (`ActionParamIssue`, plugin-sharing's `fields[]`)
  are D6 territory; plugin-sharing's own top-level code is already
  VALIDATION_FAILED.
- CLI `emitJson({ error: '...' })` output is a terminal contract read by shell
  scripts, not a request response — renaming it would break users' pipelines
  with neither a schema nor this ADR asking for it.

The line, now written down once: the catalog governs the code a failing REQUEST
answers with. Field-addressed (D6), persisted (D6b), or shipped inside a
successful response (D6c) means a different vocabulary with different consumers.

Refs #4003, #3841.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MaSQn77TT5fUgHK9CesaDK

Author: claude

content/docs/references/api/analytics.mdx

@@ -165,6 +165,7 @@ const result = ErrorCode.parse(data);
 * `DUPLICATE_REQUEST`
 * `EMAIL_SEND_FAILED`
 * `EMAIL_SERVICE_REQUIRED`
+* `ENQUEUE_FAILED`
 * `ENVIRONMENT_BIND_FAILED`
 * `ENVIRONMENT_NOT_FOUND`
 * `ENV_ACCESS_DENIED`
@@ -204,6 +205,7 @@ const result = ErrorCode.parse(data);
 * `INVALID_REQUEST`
 * `INVALID_RESUME_TOKEN`
 * `INVALID_SIGNAL`
+* `INVALID_SIGNATURE`
 * `INVALID_STATE`
 * `INVITE_EMAIL_FAILED`
 * `INVITE_REQUIRES_EMAIL`