fix(classifier): avoid forcing unsupported temperature

[tank-bohr]

Problem

Classifier calls currently force temperature: 0. Providers that do not support the parameter, including OpenAI Codex, reject the request before classification:

Unsupported parameter: temperature

pi-ai represents this as an assistant response with stopReason: "error". The classifier then treats the empty response body as malformed JSON, retries the same request, and reports a misleading invalid-JSON failure.

Changes

• Use the provider's default temperature unless a caller explicitly configures one.
• Fail closed immediately on provider-reported completion errors.
• Preserve the provider error message in classifier I/O logs and the user-facing block reason.
• Update classifier-flow and observability documentation.
• Cover default and explicit temperature behavior plus provider-reported errors.

Verification

• npm run check
• npm test (65 tests)
• npm pack --dry-run
• Live classifier call through openai-codex/gpt-5.6-sol with no temperature override returned a valid allow decision.