test(server): replay denied Claude writes through V2

[CouchRiv]

What Changed

Add a recorded Claude Write denial to the V2 orchestrator replay suite, completing the claude-v2/approvals-denied fixture TODO in #2829. The scenario checks a declined file-change approval, a failed write item, and a completed turn with Claude's final response.

Why

The recorded Claude fixtures contained allowed permission responses but no denied response. This capture uses workspace-write with on-request approval so Write is exposed and reaches the permission callback.

The recorder forwards the scenario's permission decision and uses the installed Claude executable, since this workspace excludes the SDK's bundled binaries. Replay accepts the partial stream messages the recorder already emits; output paths use the platform path service.

Captured with Claude Agent SDK 0.3.260, Claude Code 2.1.263 and claude-sonnet-4-6. The target file was not created. Workspace paths and opaque thinking signatures are redacted.

Validation: 32 focused replay/config tests and the denial and existing approval scenarios pass; one gated live-recording test is skipped. A separate protocol check completes for deny and fails at permission.response:Write when allow is substituted. Server typecheck and targeted lint/format checks pass. Live capture exercised streaming mode.

Windows replay validation included #10451's fixture-loading fix. That independent fix is not included in this diff.

Checklist

• This PR is small and focused
• I explained what changed and why

Implemented and verified with GPT-6 via Codex desktop.

[macroscopeapp]

Approvability

Verdict: Would Approve

Macroscope's review found this PR approvable — The PR adds a Claude denied-write replay fixture and supporting recorder behavior entirely within scripts and testkit code. It does not alter production request handling, product defaults, schemas, deployment, or static-analysis configuration.

Not approved because:

• Monthly spending limit reached (workspace setting). Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}