fix(api): revert approval to pending when resume fails to start

[lorenzozanee]

Summary

Answering a parked approval marks the row as responded before the resumed run is known to have started. When the workflow service returns 500 or the enqueue fails, the approval is lost — the run never starts and there is no way to retry.

This change reverts the row to pending with the error stored in resolution and returns 502 so the approval remains actionable and the failure is visible. For the async worker path, the revert happens only on the final retry to avoid races with concurrent retries. Also fixes watch publishing to emit pending on revert.

Fixes #5592.

Testing

Verified locally

• pytest oss/tests/pytest/unit/sessions/test_respond_interaction_resume_failure.py — 4 new tests (inline invoke, dispatcher, kiq enqueue failure, and success path)
• pytest oss/tests/pytest/unit/sessions/test_respond_interaction_enqueue.py — 3 existing tests still pass
• ruff format / ruff check — clean

Added or updated tests

• api/oss/tests/pytest/unit/sessions/test_respond_interaction_resume_failure.py — covers three enqueue paths reverting to pending with 502 and the success path staying responded.

QA follow-up

• Park an agent on a tool needing approval, make the resumed run fail to start, POST the approval — expect 502 and row stays pending with resolution.error.
• Verify normal approval flow (playground and out-of-band) still moves to responded/resolved.

Demo

API-only fix — approval resume failure is backend behavior. Screenshot of the new regression tests passing locally and the 502 revert behavior:

https://github.com/user-attachments/assets/demo-approval-revert.mp4

Checklist

• Demo shows the real app running this branch (not a mock-up or recreated UI), or is marked N/A
• Relevant tests pass locally
• Relevant linting and formatting pass locally
• I have signed the CLA, or I will sign it when the bot prompts me

[vercel]

@lorenzozanee is attempting to deploy a commit to the agenta projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

✅ Thanks @lorenzozanee! This PR now meets the contribution requirements and has been reopened. A maintainer will review it soon.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[mmabrouk]

thanks for the pr. i found one issue that needs a change before qa.

[mmabrouk]

The exception text is not safe to return or persist here. WorkflowDetachedStartFailed includes up to 500 bytes of the runner's raw response body (workflows/service.py:734-737), and this value is copied into both resolution.error and the HTTP 502 detail. A failed resume can therefore expose internal response data to the project user and retain it in the interaction row. Log the original exception server-side, but store and return a stable sanitized message, with a support ID if needed. Apply the same sanitization in interactions_worker.py.