fix(agent): surface model refusals as content_filter (salvage #43108 + edge-case fix) - #46013

Summary

Salvages @SHL0MS's refusal-handling fix from #43108 onto current main, with two follow-up commits that fix an edge case and apply a reuse cleanup. Authorship on the original work is preserved in git history.

A Claude model can return HTTP 200 with a refusal — a deterministic, server-side safety halt. Hermes mislabeled it as a transient infra error and retried it 3× (burning paid attempts) with no signal that the prompt was actually refused. The fix routes every backend through one normalized content_filter dispatch:

• AnthropicTransport.validate_response — accept empty content when stop_reason == "refusal" (a complete response, not a truncation), so it flows through normalize_response → content_filter.
• ChatCompletionsTransport.normalize_response — promote OpenAI's message.refusal (and the model_extra proxy variant) to content + a content_filter finish reason; bare content_filter (OpenRouter) passes straight through.
• conversation_loop.py — handle finish_reason == "content_filter" once: fire the api_request_error hook with reason=content_policy_blocked, try one configured fallback, otherwise return an honest terminal result. No retry burn — the block is deterministic.

One fix covers Anthropic-direct, Nous Portal, OpenRouter, other OpenAI-compatible providers, and Bedrock (whose guardrail_intervened already maps to content_filter), because the handler keys on the normalized finish reason rather than a path-specific flag.

Commits

1. fix(agent): surface model refusals… — @SHL0MS's original fix (authorship preserved).
2. test(transports): lock in content_filter passthrough for OpenRouter — @SHL0MS's transport tests (authorship preserved).
3. fix(transports): only treat a refusal as terminal when it is the sole payload — edge-case fix. A chat-completions response that carries real text or tool calls alongside a message.refusal note is a normal, usable turn. The prior logic flipped finish_reason → content_filter whenever a refusal string was present, so a content-bearing turn was reframed as a failed safety refusal (failed=True) and the model's actual output was buried in the "model declined" template, or its tool calls dropped. Now promotion to terminal content_filter happens only when the refusal is the sole payload (no visible text AND no tool calls); the explanation is still recorded in provider_data in every case. Refusal-only responses (the bug this PR targets) are unaffected and still surface terminally. Adds a partial-content regression guard and a tool-calls-alongside-refusal guard (both proven to fail on the prior behavior).
4. refactor(agent): share the content_policy_blocked result builder + recovery hint — the HTTP-200 refusal handler and the existing exception-path handler independently built the same terminal result dict and ended their message with the same hermes fallback add trailer copied verbatim. Funnel both through a shared _content_policy_blocked_result() builder + _CONTENT_POLICY_RECOVERY_HINT constant, collapse the HTTP-200 path's two near-identical templates into one, and pass reason=FailoverReason.content_policy_blocked.value instead of a string literal (matching the sibling hook call). Behavior-preserving: the provider-filter vs model-declined lead-in wording stays distinct, and the with-text and exception messages are byte-identical to before.

Tests

• tests/agent/transports/test_transport.py — empty-content refusal validates.
• tests/agent/transports/test_chat_completions.py — message.refusal promotion; bare content_filter passthrough (OpenRouter); no-op when absent; partial-content not terminated and tool-calls-alongside-refusal not terminated (commit 3 guards).
• tests/run_agent/test_run_agent.py::TestRetryExhaustion::test_content_filter_refusal_surfaced_not_retried — end-to-end: a portal-style message.refusal is surfaced as content_policy_blocked with the refusal text, model called exactly once (no retry loop).
• Existing tests/run_agent/test_18028_content_policy_blocked.py (exception path) stays green through the shared-helper refactor.

Local: ruff clean; full transports + run_agent + content-policy + fallback suites pass (740 passed).

Closes #43108