fix: preserve governed executor failure evidence through Agno

[brunovicco]

Phase 53 — preserve governed failure provenance through Agno

This phase closes one concrete framework-boundary gap introduced after structured executor-failure evidence became application-owned.

Concrete gap

The Agno mutable action Step already uses max_retries=0 and fail-closed error handling, but AgnoGovernedActionRuntime translated RunStatus.error into a new generic RuntimeError. That discarded the original GovernedActionExecutionError boundary even though the executor had already been invoked and the application runtime had produced structured ActionExecutionFailureEvidence.

Design

• catches only GovernedActionExecutionError inside the adapter-private Agno Step bridge;
• stores the exact governed exception outside model-controlled input/output state;
• keeps the existing max_retries=0, skip_on_failure=False, and fail-closed Agno behavior unchanged;
• when Agno reports RunStatus.error, re-raises the original governed exception rather than synthesizing a generic wrapper;
• preserves generic RuntimeError handling for non-governed Agno failures;
• keeps authorization, approval, executor-failure classification, and side-effect uncertainty application-owned.

Security invariants

• framework orchestration error status != governed failure evidence loss;
• mutable executor failure through Agno -> exactly one execution attempt + original governed failure provenance;
• RunStatus.error != authority or side-effect truth;
• raw executor exception text is not copied into structured evidence or the governed error message;
• external_side_effect_state=unknown remains unchanged.

Regression evidence

The dedicated Agno regression requires:

• exactly one executor invocation;
• caller can catch GovernedActionExecutionError;
• exact proposed action and trusted ActionContext survive;
• explicit allow evidence survives;
• execution_attempted=true;
• failure_reason=executor_error;
• external_side_effect_state=unknown;
• raw executor text is absent from structured evidence and str(error);
• the original executor RuntimeError remains only as __cause__.

CI

Functional CI #480 passed on cea0d2e0e5b57c8503e423265f89eed96bb774c9 before documentation.

Final clean CI #484 passed on fafc5aea0ca666d0abd5dbd07c89689262d83dce after documentation and removal of all temporary workflows.

The clean run passed:

• lockfile validation;
• project quality gate, including Ruff lint/format, architecture/governance checks, Pyright, pytest, Bandit, and pip-audit;
• MCP v2 compatibility + STDIO;
• governed MCP v2 compatibility + STDIO;
• authenticated governed MCP v2 compatibility + STDIO;
• OpenTelemetry analysis observation check.

Documentation

• CHANGELOG.md records Agno failure-provenance hardening and evidence;
• docs/security/GOVERNED_AGENT_ACTIONS.md now distinguishes retry suppression from preservation of typed application failure provenance.

Final scope

The final diff is limited to:

• src/agentic_lab/adapters/agno/action_workflow.py;
• tests/unit/adapters/agno/test_agno_action_workflow.py;
• CHANGELOG.md;
• docs/security/GOVERNED_AGENT_ACTIONS.md.

No temporary workflow remains. No application-runtime, policy, dependency, authentication, MCP, historical artifact, or published-release change is included. This phase adds no automatic retry, idempotency, rollback, compensation, two-phase commit, or transaction semantics.

Closes #186