Report onboarding duplicate-callback recovery through reportError (CL-7255)

[TheGreatAxios]

Summary

recentlyConnectedCredential still treats a hub/parse failure as found-nothing so the OAuth callback ends at state_expired. The catch now calls reportError with operation: "onboarding_duplicate_callback_recovery" and extra.userId, and no longer interpolates the raw cause.message into the operational log.

Verification

• bun test packages/onboarding/test/report-error-routing.test.ts before the implementation: 4 pass, 1 fail, exit 1 (reportErrorCalls length 0).
• Same file after the implementation: 5 pass, 0 fail, exit 0.
• bun test packages/onboarding/src packages/onboarding/test/report-error-routing.test.ts packages/onboarding/test/openrouter-connect-routes.test.ts packages/onboarding/test/huggingface-connect-routes.test.ts packages/onboarding/test/routes.test.ts: 72 pass, 0 fail, exit 0.
• cd packages/onboarding && bunx tsc --noEmit: exit 0.
• bun run typecheck: exit 0.
• bun run check:report-error: exit 0 (baseline shrunk by the fixed catch).
• bun run check: typecheck and lint passed (eslint 0 errors / 10 pre-existing warnings). The test step failed in scripts/db-setup.test.ts with PostgresError: password authentication failed for user "thegreataxios" (pre-existing local DATABASE_URL, unrelated to this change).

Fixes CL-7255

[TheGreatAxios]

Self-review

Verdict: the fix correctly routes the duplicate-callback recovery catch through reportError (operation onboarding_duplicate_callback_recovery, extra.userId), stops interpolating the raw cause message into the log line, and the new test proves a secret-shaped parse failure never reaches logs while still ending as state_expired. No defects found.

• Catch block now calls reportError(cause, ...) and logs only [refId] instead of the raw message — CONFIRMED (checked packages/onboarding/src/routes.ts:289-300; the log line no longer contains message).
• reportError's redaction path (redactedCopyOf/redactExtra/redactText in packages/error-sink/src/index.ts) is the actual mechanism keeping the secret out of the sink, and the test's not.toContain(SECRET) assertion checks logs+context, not the sink internals — DISMISSED (this is the intended boundary: reportError owns redaction, the caller just needs to stop hand-rolling a message).
• context.tenantId omitted rather than passed as undefined — consistent with exactOptionalPropertyTypes convention — DISMISSED (correct as written).
• report-error-baseline.txt entry for this line removed — CONFIRMED (baseline can only shrink; check:report-error passes with 0 new findings, 0 stale entries).

Targeted tests:

• bun test packages/onboarding/test/report-error-routing.test.ts — 5 pass, 0 fail.
• bun run typecheck — pass.
• bun run check:report-error — ok, 0 new findings, 0 stale baseline entries.

No fixes needed; no commits pushed.

[linear-code]

CL-7255