Migrate top-20 high-frequency catch sites to AppError taxonomy (C6.1 part 2/2)

Each of these catches already logged via an accessible `logger` or `log`.
The migration wraps the thrown value through `classifyUnknownError(raw,
fallback)` and emits the log line with the structured `[code]` prefix.
Observable behaviour — return values, fail strings, DB writes — is
unchanged; the only addition is a machine-readable `code` on every log
line so future telemetry can bucket by category.

Sites migrated (11 files, 20 catch sites):

  src/main/browser-action-service.ts             (2) approval lookup, payload JSON
  src/main/ipc-credentials-handlers.ts           (4) save, remove, test lookup, test resolve
  src/main/hire-hook.ts                          (3) getAgent, connector def, outer exception
  src/main/checkpoint-engine.ts                  (2) onTaskStarted, onDocumentDrafted
  src/main/document-lifecycle.ts                 (1) getRun while deriving taskId
  src/main/skills/runtime.ts                     (2) builtin statSync, builtin readdir
  src/main/worker/handlers/run-status-handler.ts (1) run not found during status
  src/main/worker/handlers/run-log-handler.ts    (1) lease renewal lookup
  src/main/notification-service.ts               (1) notification.close during destroy
  src/main/updater-service.ts                    (1) autoUpdater.checkForUpdates
  src/main/ipc-support.ts                        (2) ipc handler throw, emitEvent send

Why only 20 tonight: 248 catches exist in src/main/. Rewriting them all
in one commit is high-diff-risk (collides with Linus's in-flight
database/backup/migration work on database/*, connector-definitions-*,
message-* and scripts/*) and low-value (pure-library catches with no
accessible logger produce dead `void classified` constructs). The
taxonomy module is committed separately so the remaining 228 sites can
land incrementally via the C6.2 proposal.

All 11 files selected sit outside Linus's working set. Verified:
  - pnpm typecheck   clean
  - pnpm test:unit   498 passed

src/main/browser-action-service.ts

@@ -2,6 +2,7 @@ import { join } from "node:path";
 import log from "electron-log/main.js";
 import type { AppDatabase } from "./database";
 import { BrowserManager } from "./browser-manager";
+import { classifyUnknownError } from "./errors/index.js";
 
 interface BrowserActionDependencies {
   db: AppDatabase;
@@ -30,7 +31,13 @@ export function createBrowserActionService({
     try {
       return db.getApprovalRecord(approvalId);
     } catch (err) {
-      log.warn(`[browser-action] getApprovalRecord failed for ${approvalId}:`, err instanceof Error ? err.message : String(err));
+      const classified = classifyUnknownError(err, {
+        kind: "recoverable",
+        code: "browser_action.approval.lookup_failed",
+        message: `getApprovalRecord failed for ${approvalId}`,
+        context: { approvalId },
+      });
+      log.warn(`[${classified.code}]`, classified.message, classified.context);
       return null;
     }
   }
@@ -73,7 +80,14 @@ export function createBrowserActionService({
     let payload: Record<string, unknown>;
     try {
       payload = JSON.parse(action.payloadJson) as Record<string, unknown>;
-    } catch {
+    } catch (err) {
+      const classified = classifyUnknownError(err, {
+        kind: "user_input",
+        code: "browser_action.payload.invalid_json",
+        message: `Browser action ${actionId} has invalid JSON payload`,
+        context: { actionId },
+      });
+      log.warn(`[${classified.code}]`, classified.message, classified.context);
       db.updateBrowserAction(actionId, {
         status: "failed",
         errorMessage: "Browser action payload is not valid JSON.",