fix(handlers): canonical error envelope (request_id) on 3 agent-facing branches

[mastermanas805]

What

Three agent-facing error branches emitted a bespoke envelope missing request_id (and one used a non-standard "msg" key), so an agent couldn't correlate the failure to logs/support the way every respondError path allows.

Site	Before	After
onboarding.go ClaimPreview invalid_token (not-found)	{ok,error,msg}	respondError → {ok,error,message,request_id}
env_policy.go Put owner_required 403	{ok,error,role,allowed_roles,agent_action}	+ request_id
resource.go respondPauseUpgradeRequired 402	{ok,error,message,upgrade_url,agent_action}	+ request_id

Why it's safe

Additive only (request_id), plus the msg→message rename on a branch whose documented shape was just {ok,error}. The machine-readable error keyword (what clients branch on) is unchanged on all three.

Symptom:        agent-facing 4xx missing request_id / non-canonical "msg" key
Enumeration:    grep across handlers for bespoke c.Status().JSON error envelopes
Sites found:    3 genuine agent-facing (webhook/HTML-page sites excluded as server-to-server / human-facing)
Sites touched:  3
Coverage:       all 3 changed lines covered by existing tests (count=1)
Live verified:  go test against real Postgres+Redis, green

🤖 Generated with Claude Code