An infrastructure error reaches the client with its whole text

[phas02]

What it buys: a client reads the refusal it can act on, and the
deployment's own addresses stay in the log. A statement error that
names a column is the product; an object-store error that names a
bucket, a catalog endpoint or a file path is the operator's.

What stands: SessionError wraps the substrate's errors transparently
— DataFusion, Arrow, Lake (the catalog, and through it
iceberg::Error), Import, Store
(crates/session/src/session.rs, SessionError). Both doors print
the error's whole text: the query door through fail(…, e.to_string()) (crates/serverd/src/query.rs), the agent door
through e.to_string() into the tool result
(crates/serverd/src/mcp.rs, call_tool). Nothing between the two
tells a planning refusal from an I/O failure, so a failed warehouse
read or catalog call reaches the client with the URL it failed on.

Every request already runs inside a span that carries its trace id
(crates/serverd/src/telemetry.rs, request_span), so the text has a
place to go and the client can be handed the id that finds it.

The line to draw is the open part: which error classes are the
client's whole (parse, plan, the language's own refusals), and which
answer by name with the trace id while their text goes to the log
(object store, catalog transport, spill disk).

Done when: the classes are named in docs/reference/doors.md, the
doors render an infrastructure error as its name and the request's
trace id, the full text is an error event on the request span, and a
door test over a failing object store shows no URL in the response.