fix: #18 Report publish access denials as a failed publish

Closes #18 (closed)

What changed

AutoSavePublisher::publish() now catches AccessDeniedHttpException from Canvas's publish controller and returns a failed publish with status 403 and the exception message. PublishAutoSavesTool turns that into Publish failed: Unable to update entities: 'Locked page'.

Before, the exception escaped to ToolBase::execute(), which logged it as an error and told the agent:

Tool execution failed: Drupal\Core\Http\Exception\CacheableAccessDeniedHttpException. The full error has been logged.

Canvas throws both of its publish denials (entity update access and field access) before it opens its transaction, so nothing is written when the publish is denied.

Testing

testPublishAccessDenialNamesTheEntity() drafts a change to a page that canvas_tools_test locks for update, then runs publish-all as an editor. It asserts the publish fails and the message names the page. It fails without the fix.

The message goes through the tool's @message placeholder, so the quotes around the label are HTML-escaped ('). That's how every other publish failure reaches the agent today. The fix belongs in the invokers, which should render result messages as plain text: tool#3583042 (closed).

🤖 Generated with Claude Code