Migrate top-20 high-frequency catch sites to AppError taxonomy (C6.1 part 2/2)

Each of these catches already logged via an accessible `logger` or `log`.
The migration wraps the thrown value through `classifyUnknownError(raw,
fallback)` and emits the log line with the structured `[code]` prefix.
Observable behaviour — return values, fail strings, DB writes — is
unchanged; the only addition is a machine-readable `code` on every log
line so future telemetry can bucket by category.

Sites migrated (11 files, 20 catch sites):

  src/main/browser-action-service.ts             (2) approval lookup, payload JSON
  src/main/ipc-credentials-handlers.ts           (4) save, remove, test lookup, test resolve
  src/main/hire-hook.ts                          (3) getAgent, connector def, outer exception
  src/main/checkpoint-engine.ts                  (2) onTaskStarted, onDocumentDrafted
  src/main/document-lifecycle.ts                 (1) getRun while deriving taskId
  src/main/skills/runtime.ts                     (2) builtin statSync, builtin readdir
  src/main/worker/handlers/run-status-handler.ts (1) run not found during status
  src/main/worker/handlers/run-log-handler.ts    (1) lease renewal lookup
  src/main/notification-service.ts               (1) notification.close during destroy
  src/main/updater-service.ts                    (1) autoUpdater.checkForUpdates
  src/main/ipc-support.ts                        (2) ipc handler throw, emitEvent send

Why only 20 tonight: 248 catches exist in src/main/. Rewriting them all
in one commit is high-diff-risk (collides with Linus's in-flight
database/backup/migration work on database/*, connector-definitions-*,
message-* and scripts/*) and low-value (pure-library catches with no
accessible logger produce dead `void classified` constructs). The
taxonomy module is committed separately so the remaining 228 sites can
land incrementally via the C6.2 proposal.

All 11 files selected sit outside Linus's working set. Verified:
  - pnpm typecheck   clean
  - pnpm test:unit   498 passed

src/main/hire-hook.ts

@@ -1,6 +1,7 @@
 import log from "electron-log/main.js";
 import { getConnectorDefinition } from "./connectors";
 import type { AppDatabase } from "./database";
+import { classifyUnknownError } from "./errors/index.js";
 
 /**
  * Payload captured when an agent hire is approved. Kept for call-sites that
@@ -36,16 +37,28 @@ export async function notifyHireApproved(
     let agent;
     try {
       agent = db.getAgent(input.agentId);
-    } catch {
-      log.warn(`[hire-hook] Agent ${input.agentId} not found, skipping hire notification.`);
+    } catch (err) {
+      const classified = classifyUnknownError(err, {
+        kind: "recoverable",
+        code: "hire_hook.agent.not_found",
+        message: `Agent ${input.agentId} not found, skipping hire notification`,
+        context: { agentId: input.agentId, companyId: input.companyId },
+      });
+      log.warn(`[${classified.code}] ${classified.message}`);
       return;
     }
 
     let connectorDef;
     try {
       connectorDef = getConnectorDefinition(agent.connectorId);
-    } catch {
-      log.warn(`[hire-hook] No connector definition for ${agent.connectorId}, skipping hire notification.`);
+    } catch (err) {
+      const classified = classifyUnknownError(err, {
+        kind: "recoverable",
+        code: "hire_hook.connector.not_found",
+        message: `No connector definition for ${agent.connectorId}, skipping hire notification`,
+        context: { connectorId: agent.connectorId, agentId: input.agentId },
+      });
+      log.warn(`[${classified.code}] ${classified.message}`);
       return;
     }
 
@@ -73,8 +86,14 @@ export async function notifyHireApproved(
       detail: `Hire approved: ${payload.agentName} via ${connectorDef.id}`,
     });
   } catch (error) {
+    const classified = classifyUnknownError(error, {
+      kind: "upstream",
+      code: "hire_hook.notify.exception",
+      message: `Exception notifying hire for agent ${input.agentId}`,
+      context: { agentId: input.agentId, companyId: input.companyId },
+    });
     const message = error instanceof Error ? error.message : String(error);
-    log.error(`[hire-hook] Exception notifying hire for agent ${input.agentId}: ${message}`);
+    log.error(`[${classified.code}] ${classified.message}: ${message}`);
     try {
       db.addActivity({
         companyId: input.companyId,