Tell the agent its handoff was rejected instead of looping on the file

A refused handoff had no feedback loop. PrepareRelease read the report, the
parser refused it, the worker recorded the error in health, and the next
boundary read the same bytes and refused them again. Run 10 spent four leases
that way and the agent was never told anything.

The plan-progress path already had the answer: answerRefusedProgress says why,
drops the file, and lets the agent write a corrected one. The release path now
does the same, gated on a typed ErrInvalidHandoffAnswer so a transport or Git
failure keeps its retry.

This is the silent-loop shape CLAUDE.md names, in a path nobody had checked.
The three format fixes above it each removed one trigger; this removes the
loop.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVbaKucEYBjMqVeUgJUsc1

internal/herdr/adapter_test.go

@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"context"
 	"encoding/json"
+	"errors"
 	"net"
 	"orchestra/internal/continuity"
 	"os"
@@ -428,3 +429,23 @@ func TestHandoffPromptStatesTheLimitOnEveryBoundedField(t *testing.T) {
 		}
 	}
 }
+
+// A badly authored handoff must be distinguishable from a transport failure,
+// because only the first is the agent's to correct. Run 10 spent four leases
+// re-reading the same refused report at every boundary.
+func TestInvalidHandoffAnswerIsTyped(t *testing.T) {
+	long := strings.Repeat("x", 219)
+	_, err := canonicalHandoff(Session{Worktree: t.TempDir()}, `NEXT: a
+WHY: b
+REMAINING: c
+DEAD ENDS: NONE
+OPEN Q: `+long+`
+LEARNED: e
+`, "")
+	if !errors.Is(err, ErrInvalidHandoffAnswer) {
+		t.Fatalf("an over-long authored field must be ErrInvalidHandoffAnswer, got %v", err)
+	}
+	if !strings.Contains(err.Error(), "219") {
+		t.Errorf("the refusal does not name the length: %v", err)
+	}
+}