Fail-closed review wrappers should preserve safe failure classes
Fail-closed review-output redaction should preserve a sanitized failure class and numeric exit status; suppressing every diagnostic prevents unsafe disclosure but also makes deterministic recovery impossible. This applies to delegated tooling where raw subprocess output may conta…