fix(buzz-agent): recover from context-window 400s instead of sticking

[wpfleger96]

Provider context_length_exceeded 400s permanently wedged agent sessions: the turn errored, the oversized history persisted in the in-memory session, and the usage baseline stayed frozen at the last successful sub-threshold reading (failed requests report no usage), so the preflight handoff gate never fired again — every later prompt failed identically until an agent restart. The byte-truncation fallback never intervened because it is a request-body limiter (estimated_bytes), not a context-window defence; at context-window scale it is a measured no-op.

This adds the reactive recovery path:

• Typed classification. AgentError::LlmContextExceeded is classified at both non-success provider terminals — the shared post() (Anthropic, OpenAI, Databricks) and openrouter_post() — on status == 400 plus a context-window body match, so ordinary 400s stay terminal.
• Forced handoff. A context-400 forces a summarize-handoff that bypasses should_handoff() and BUZZ_AGENT_MAX_HANDOFFS, bounded by its own per-turn budget (MAX_CONTEXT_RECOVERIES_PER_RUN = 3).
• Shrink ladder. The summarize prompt budget halves from the observed rejected history size — not from max_context_tokens, the number the provider just contradicted — rung to rung, with a 4096-byte floor. A summarize call rejected for the same reason takes the next rung instead of re-sticking. At the floor (overflow dominated by unshrinkable frame: system prompt, tool schemas, live prompt) recovery is refused and the provider error surfaces clearly instead of self-healing.
• Baseline reset. The stale usage baseline is cleared when a request fails, so the preflight gate cannot stay frozen sub-threshold on retries.

Named behavior changes:

1. Anthropic and OpenRouter errors now carry the (model) stamp. Provider arms return their Result into the central error mapper instead of early-returning past it, making the code match its documented single-convergence contract at that mapper.
2. max_rounds now counts completions the loop acts on. A request rejected with a context-400 that is then successfully recovered refunds its round before the retry, paired 1:1 with a consumed recovery rung, so the round cap is neither weakened nor able to drop a recovered turn unanswered.

Related: #4805 — the complementary proactive fix (per-session handoff-cap kill switch that let sessions grow to the provider wall). #4805 prevents reaching the wall; this PR recovers at it.