#10261: fix(agents): prevent exec tool errors from leaking to channels (#9651)

## Summary - When the exec tool returns a non-zero exit code, stderr/stdout content was forwarded as a visible message to the active messaging channel (WhatsApp, Telegram, etc.), leaking internal details - Skip calling `emitToolOutput()` when `isToolError` is true in `handleToolExecutionEnd()`, so error content stays in the agent context only and is never forwarded to channels Fixes #9651 ## Test plan - [x] 4 new tests for `handleToolExecutionEnd()`: successful output emission, error output suppression (isError flag), error output suppression (isToolResultError detection), lastToolError recording - [x] All 4 tests pass - [x] `pnpm check` passes (0 warnings, 0 errors) <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> - Updates `handleToolExecutionEnd` to skip `emitToolOutput()` when the tool execution is considered an error (`isError` or `isToolResultError`). - Adds a new Vitest suite exercising success emission, suppression on `isError`, suppression via `isToolResultError`, and `lastToolError` recording. - Intended to prevent exec/batch stderr/stdout from being forwarded to external messaging channels by avoiding the tool-output emission path. <h3>Confidence Score: 3/5</h3> - This PR likely addresses one leak path, but may still allow error tool output to be surfaced via tool result events. - Change correctly gates `emitToolOutput()` behind `!isToolError` and adds tests for that behavior, but `emitAgentEvent` still includes `result: sanitizedResult` even on error; if any downstream consumer forwards tool result events to external channels, the original leak may persist. Confidence is reduced until the full external-forwarding path is confirmed/redacted. - src/agents/pi-embedded-subscribe.handlers.tools.ts (error tool result emission via emitAgentEvent) <!-- greptile_other_comments_section --> <!-- /greptile_comment -->