fix(efficacy): an empty final message carries the judge CLI's cause (#1768)

[braboj]

Closes #1768.

A codex exec refused by the model creates its --output-last-message file
before the call and leaves it empty. judge_bundle then reported the final message was not JSON: and nothing more, and the cause, which the CLI printed
to standard error, was dropped.

Change

• An empty or unreadable final message now records the final message was empty (or not JSON: <text>) followed by the CLI said: <tail>, the last
  400 characters of what the CLI printed.
• cli_said reads that tail for both failure branches, the missing-file one
  included, which already carried it inline.
• The claude backend already reports its standard error when it prints
  nothing; unchanged.

Check

The self test's stand-in CLI gains a refusal mode, set by
FAKE_CODEX_REFUSES: it creates the message file empty, writes the cause to
standard error and exits 1, as the real CLI did. The new check requires the
file to exist and be empty (so the failure is read from the no-JSON branch,
not the missing-file one), the error to say was empty, and the planted cause
to be in it.

Control: with the cause removed from the error (cli_said(outcome) replaced
by "", landing asserted, reverted from a commit), that check goes FAILED,
20/21.

judge.py --self-test 21/21. Smoke 33/33. Conformance 22 passed, 0 failed;
readings: no other open PR, no off-limits path, and the one existing test
changed is the stand-in CLI, which gains the refusal mode behind an
environment variable and behaves as before without it.

No CHANGELOG entry: the benchmark's tooling is not observable by a consuming
project.

🤖 Generated with Claude Code