[TheGreatAxios]

What changed

• ProjectError turns an arktype errors object into the {path, message} list, the only form the workflow HTTP layer passes on to an agent's tool result. Before this, reasons were .summary strings, so a model saw only {"code":"invalid_artifact_write","status":400} and repeated the same call.
• Every hub refusal that sent issues: x.summary now sends issues: x, a one-word change at each site. Strings no longer typecheck as issues.
• Reasons name the rule, never the submitted value: issue.expected is used for narrow/type rules, is not allowed here for undeclared keys, and is not one of the allowed values for unions whose description embeds the value.
• The document write's hand-written checks name their field with what to do, for example approaches: "goes on the approaches document; write this problem_brief without it".
• Security refusals (403/404) still carry only a code.

Folds in #52.

How it was verified

• apps/hub/src/projects/errors.test.ts runs write_artifact through the workflow HTTP layer against the hub routes and checks typeIssues across .narrow(), unions and undeclared keys with no submitted value in any message.
• bun run test, lint, format and typecheck pass.

Refs CL-11925, CL-11927

[linear-code]

CL-11925

CL-11927

[corbits-triage]

Triage: Pass

No changes needed from you. A maintainer will review this pull request.

Triage will approve, request review.