fix: preserve workdir failure diagnostics across transport

crates/worker/src/checkout_http_tests.rs

@@ -57,6 +57,7 @@ impl ProviderState {
             return Err((
                 StatusCode::UNAUTHORIZED,
                 AxumJson(WorkdirTransportError {
+                    failure_reason: None,
                     denial_reason: None,
                     code: WorkdirTransportErrorCode::Denied,
                     message: "provider authorization denied".into(),

crates/worker/src/feature/builtin/manage_workdir.rs

@@ -409,10 +409,20 @@ impl WorkdirSession for WorkspaceAttachedWorkdirSession {
                 "mismatched checkout mutation response".into(),
             )),
             Ok(_) => Err(Self::mismatch("checkout_execute")),
-            Err(WorkdirError::Transport(_) | WorkdirError::Unavailable(_)) if mutation => {
-                Err(WorkdirError::OutcomeUnknown(
+            Err(error)
+                if mutation
+                    && matches!(
+                        error.classification_source(),
+                        WorkdirError::Transport(_) | WorkdirError::Unavailable(_)
+                    ) =>
+            {
+                let outcome = WorkdirError::OutcomeUnknown(
                     "checkout mutation response lost; inspect effects before retry".into(),
-                ))
+                );
+                Err(match error.failure_reason() {
+                    Some(reason) => outcome.with_failure_reason(reason),
+                    None => outcome,
+                })
             }
             Err(error) => Err(error),
         }
@@ -1230,6 +1240,7 @@ mod tests {
         WorkspaceResponse {
             status,
             body: serde_json::to_string(&workdir::http::WorkdirTransportError {
+                failure_reason: None,
                 denial_reason: None,
                 code,
                 message: message.to_string(),

crates/worker/tests/controller_test.rs

@@ -480,7 +480,7 @@ async fn shutdown_closes_bound_workdir_session() {
 
     assert!(matches!(
         session.command_status(command).await,
-        Err(WorkdirError::Unavailable(_))
+        Err(ref error) if matches!(error.classification_source(), WorkdirError::Unavailable(_))
     ));
 }
 
@@ -758,7 +758,7 @@ async fn controller_startup_failure_closes_bound_workdir_session() {
                 tool_call_id: None,
             })
             .await,
-        Err(WorkdirError::Unavailable(_))
+        Err(ref error) if matches!(error.classification_source(), WorkdirError::Unavailable(_))
     ));
 }