refactor: extract services layer, Result type, and ErrorCode classification

- Add DI container (src/services/) with AgentExecutionService, ConfigLoaderService, and ExploitationCheckerService — pure domain logic with no Temporal dependencies
- Introduce Result<T, E> type and ErrorCode enum for code-based error classification in classifyErrorForTemporal, replacing scattered string matching
- Consolidate billing/spending cap detection into utils/billing-detection.ts with shared pattern lists across message-handlers, claude-executor, and error-handling
- Extract LogStream abstraction for append-only logging with backpressure, used by both AgentLogger and WorkflowLogger
- Simplify activities.ts from inline lifecycle logic to thin wrappers delegating to services, with heartbeat and error classification
- Expand config-parser with human-readable AJV errors, security validation, and rule type-specific checks

src/queue-validation.ts

@@ -6,6 +6,8 @@
 
 import { fs, path } from 'zx';
 import { PentestError } from './error-handling.js';
+import { ErrorCode } from './types/errors.js';
+import { type Result, ok, err } from './types/result.js';
 import { asyncPipe } from './utils/functional.js';
 
 export type VulnType = 'injection' | 'xss' | 'auth' | 'ssrf' | 'authz';
@@ -67,11 +69,10 @@ export interface ExploitationDecision {
   vulnType: VulnType;
 }
 
-export interface SafeValidationResult {
-  success: boolean;
-  data?: ExploitationDecision;
-  error?: PentestError;
-}
+/**
+ * Result type for safe validation - explicit error handling.
+ */
+export type SafeValidationResult = Result<ExploitationDecision, PentestError>;
 
 // Vulnerability type configuration as immutable data
 const VULN_TYPE_CONFIG: VulnTypeConfig = Object.freeze({
@@ -196,7 +197,8 @@ const validateExistenceRules = (
           deliverablePath: pathsWithExistence.deliverable,
           queuePath: pathsWithExistence.queue,
           existence,
-        }
+        },
+        ErrorCode.DELIVERABLE_NOT_FOUND
       ),
     };
   }
@@ -311,15 +313,18 @@ export async function validateQueueAndDeliverable(
   );
 }
 
-// Pure function to safely validate (returns result instead of throwing)
-export const safeValidateQueueAndDeliverable = async (
+/**
+ * Safely validate queue and deliverable files.
+ * Returns Result<ExploitationDecision, PentestError> for explicit error handling.
+ */
+export async function validateQueueSafe(
   vulnType: VulnType,
   sourceDir: string
-): Promise<SafeValidationResult> => {
+): Promise<SafeValidationResult> {
   try {
     const result = await validateQueueAndDeliverable(vulnType, sourceDir);
-    return { success: true, data: result };
+    return ok(result);
   } catch (error) {
-    return { success: false, error: error as PentestError };
+    return err(error as PentestError);
   }
-};
+}