* Abort approved workflow pushes when proxy elevation fails
When _run_with_workflow_token cannot elevate the sandbox proxy token to
workflows:write, it now returns a clear ToolMessage error instead of running
the push over the base token and getting a raw GitHub remote rejection.
Refs: #97
* Fix workflow push guard crash and non-langsmith regression
- Thread the ToolCallRequest into _run_with_workflow_token so the
WorkflowPushElevationFailed ToolMessage is stamped with the real
tool_call_id instead of an empty id that crashes the Anthropic API.
- Only perform the elevation/abort path on SANDBOX_TYPE=langsmith;
other providers run the approved push directly.
- Add tests covering the real tool_call_id, single refresh call, and
non-langsmith approved pushes.
Refs: #97
---------
Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com>
421290d066