fix(actions): default outcome to Private Note for hidden actions, surface Halo validation errors

[wyre-agent-fleet]

Summary

• Aaron hit this live (ticket 16794, action ci: adopt codeql-action v4 (node24) via reusable-workflow pin bump #64): Halo's API rejects a posted action with no outcome field, even when hidden_from_user is set. It read as intermittent because it only bit when the caller omitted outcome — action ci: adopt codeql-action v4 (node24) via reusable-workflow pin bump #64 succeeded once outcome was supplied.
• halopsa_tickets_add_action now defaults outcome to "Private Note" when hidden_from_user is true and the caller didn't supply one. Visible (non-hidden) actions are left unchanged — no evidence yet on whether they need a different default, so this only fixes the reported case.
• Separately: the top-level tool-call catch in mcp-server.ts only surfaced error.message, which is just "Validation error" for a HaloPsaValidationError — the actual field-level detail (error.errors) was silently discarded. Now surfaced, so any future Halo validation rejection names the specific field instead of a generic message.

Test plan

• npm run typecheck — clean
• npx vitest run — 149/149 passing (2 new tests covering the default-outcome and no-default-for-visible-actions cases)
• npm run lint — clean

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 00941464-5489-420f-ad99-804bef8eb401

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}