fix(server): sanitize legacy adapter failures

[bokelley]

Summary

• centralize legacy adapter exception-to-wire policy for MCP and A2A
• replace unexpected request/response adapter exception text with fixed public messages while retaining traceback logs
• add an explicit buyer-safe validation exception for actionable request errors
• cover request and response failures through real MCP and A2A JSON-RPC ASGI routes

Validation

• 7,611-test full suite passed
• repository pre-commit hooks passed (Black, Ruff, mypy, adopter type checks, Bandit, safety checks)
• three independent expert reviews completed; no open findings

Closes #1126

---

Open workspace in Conductor

[aao-secretariat]

Ladon verdict: Approve

Approve — clean, well-scoped error-disclosure fix for the legacy adapter.

Checked:

• No Critical/High/Medium findings reported by the reviewer.
• Legacy-adapter exception text is now routed through legacy_adapter_task_error, which fail-closes: only an explicit opt-in LegacyAdapterValidationError on the request phase surfaces its author-written message; all other failures return fixed public text with the traceback logged operator-side only. This is a security-hardening improvement (prevents internal exception detail leaking onto the wire).
• Dual-transport (MCP + A2A) and dual-phase test coverage confirms the sentinel never reaches the wire; two new test files back the new branches.

Gate checks:

• gated_paths is false, so row 2 does not apply despite review_decision: REVIEW_REQUIRED.
• high_risk is true, but reasons are (added)/(modified) with no medium-or-higher findings, so rows 3–5 do not fire. New-file additions and clean modifications on high-risk paths are presumed safe absent findings.
• No no-auto-approve team match (row 7 n/a). Fewer than three medium findings (row 8 n/a).

Falls through to row 9 → approve.