sanitizeResponsesProviderFailureTerminal ordering

Trap: validating only terminal status before applyResponsesEvent() looks sufficient, but output reconciliation can mutate trusted accumulator state for an early item before a later item fails. Fix: fully prevalidate failed/cancelled terminals and restore the exact pre-terminal snapshot on any reconciliation failure; then emit one fixed response.failed from trusted metadata with empty output, null public usage, contiguous sequencing, and no leaked extensions.