Responses failed projections and usage accounting

Trap: exposing accumulated output from failed Responses, trusting failed terminal identity/model/time/diagnostics, or waiting for downstream demand before accounting seems useful, but unsuccessful output is non-authoritative and cancellation or backpressure can suppress usage. Fix: after transactional rollback, finalize unsuccessful completion exactly once before any demand wait or fallible enqueue. Preserve only validated private usage for accounting; keep public usage null and callback output empty. Failed projections must expose empty output, content, and rawOutputItems, retain trusted created/in-progress metadata, and emit the fixed sanitized failure.