Migrate top-20 high-frequency catch sites to AppError taxonomy (C6.1 part 2/2)

Each of these catches already logged via an accessible `logger` or `log`.
The migration wraps the thrown value through `classifyUnknownError(raw,
fallback)` and emits the log line with the structured `[code]` prefix.
Observable behaviour — return values, fail strings, DB writes — is
unchanged; the only addition is a machine-readable `code` on every log
line so future telemetry can bucket by category.

Sites migrated (11 files, 20 catch sites):

  src/main/browser-action-service.ts             (2) approval lookup, payload JSON
  src/main/ipc-credentials-handlers.ts           (4) save, remove, test lookup, test resolve
  src/main/hire-hook.ts                          (3) getAgent, connector def, outer exception
  src/main/checkpoint-engine.ts                  (2) onTaskStarted, onDocumentDrafted
  src/main/document-lifecycle.ts                 (1) getRun while deriving taskId
  src/main/skills/runtime.ts                     (2) builtin statSync, builtin readdir
  src/main/worker/handlers/run-status-handler.ts (1) run not found during status
  src/main/worker/handlers/run-log-handler.ts    (1) lease renewal lookup
  src/main/notification-service.ts               (1) notification.close during destroy
  src/main/updater-service.ts                    (1) autoUpdater.checkForUpdates
  src/main/ipc-support.ts                        (2) ipc handler throw, emitEvent send

Why only 20 tonight: 248 catches exist in src/main/. Rewriting them all
in one commit is high-diff-risk (collides with Linus's in-flight
database/backup/migration work on database/*, connector-definitions-*,
message-* and scripts/*) and low-value (pure-library catches with no
accessible logger produce dead `void classified` constructs). The
taxonomy module is committed separately so the remaining 228 sites can
land incrementally via the C6.2 proposal.

All 11 files selected sit outside Linus's working set. Verified:
  - pnpm typecheck   clean
  - pnpm test:unit   498 passed

src/main/checkpoint-engine.ts

@@ -16,6 +16,7 @@ import {
   CHECKPOINT_TASK_TYPES,
   STRATEGY_DOCUMENT_TYPES,
 } from "./execution-policy";
+import { classifyUnknownError } from "./errors/index.js";
 
 interface CheckpointDeps {
   db: AppDatabase;
@@ -81,7 +82,12 @@ export function createCheckpointEngine(deps: CheckpointDeps) {
         publishDomainChanged();
         return approvalId;
       } catch (err) {
-        logger.error(`[checkpoint] onTaskStarted failed: ${err instanceof Error ? err.message : String(err)}`);
+        const classified = classifyUnknownError(err, {
+          kind: "recoverable",
+          code: "checkpoint.on_task_started.failed",
+          message: "onTaskStarted failed",
+        });
+        logger.error(`[${classified.code}] ${classified.message}: ${err instanceof Error ? err.message : String(err)}`);
         return null;
       }
     },
@@ -123,7 +129,12 @@ export function createCheckpointEngine(deps: CheckpointDeps) {
         publishDomainChanged();
         return approvalId;
       } catch (err) {
-        logger.error(`[checkpoint] onDocumentDrafted failed: ${err instanceof Error ? err.message : String(err)}`);
+        const classified = classifyUnknownError(err, {
+          kind: "recoverable",
+          code: "checkpoint.on_document_drafted.failed",
+          message: "onDocumentDrafted failed",
+        });
+        logger.error(`[${classified.code}] ${classified.message}: ${err instanceof Error ? err.message : String(err)}`);
         return null;
       }
     },