fix: preserve agent and readiness failures

[abrichr]

What changed

• Preserve provider, parser, planner, and missing-observation failures as terminal error actions instead of clean done actions.
• Keep explicit model decisions distinct: DONE remains done, FAIL becomes error, and WAIT remains wait.
• Require a readable and confirmed unlocked Windows desktop before the WAA recovery helper reports readiness.

Why

The evaluation harness treats done as a model completion claim. Several failure paths used the same action type, which erased the difference between task completion and an agent or infrastructure failure. The WAA helper also reported readiness after a successful probe even when lock-screen inspection failed or unlock input did not take effect.

Validation

• 376 focused agent and false-success tests passed.
• 1,739 repository tests passed; 62 skipped.
• The remaining broad-suite failures were pre-existing environment requirements: local openadapt-capture, a writable home session directory, repository-only synthetic demo assets, and one cross-repository test that expects the currently released openadapt-ml behavior.
• Ruff passed for every changed Python file.
• git diff --check passed.