Harden ApiError: AccessDeniedError subclass + stricter input validation

[jramos]

Summary

Follow-up to PR #9. Four commits hardening CgminerApiClient::ApiError and adding a dedicated subclass for the most-commonly-dispatched-on case.

• CgminerApiClient::AccessDeniedError < ApiError — covers cgminer's STATUS=E Code 45 response and the gem's own access_denied? local guard. Inherits from ApiError so existing rescue ApiError clauses still catch it; callers wanting finer dispatch use rescue AccessDeniedError instead of case e.code; when :access_denied. Constructor pins code: :access_denied so the symbolic tag is consistent regardless of which call site raised.

• ApiError.for_status(c, msg) factory — centralized at the wire-side emission point. Picks AccessDeniedError when the cgminer integer maps to :access_denied, falls back to ApiError otherwise. Wire boundary stays best-effort: a non-numeric Code coerces to nil and the symbolic tag becomes :unknown rather than raising mid-poll.

• Stricter constructor input validation — cgminer_code: must be Integer or nil; code: must be Symbol, String, or nil. Bad input raises ArgumentError with a clear message instead of silently producing code: :unknown (string cgminer_code) or NoMethodError deep in the constructor (code: 42). code: false is now also rejected loudly rather than silently bypassing to map lookup.

• Forward-rot guard — precondition test asserting CGMINER_CODES has no key for 23, so a future PR mapping it trips loudly instead of silently degrading the existing :unknown-fallback test that depends on 23 being unmapped.

• Docs — errors.rb block-doc trimmed and corrected (the prior factually wrong "before any wire interaction" claim about access_denied? was already fixed in PR Attach structured cgminer_code and code symbol to ApiError #9, but the block doc still echoed the same misframing). CHANGELOG / AGENTS.md gain a "prefer e.code for dispatch over e.cgminer_code" advisory and drop the cgminer 4.11.1 version pin in favor of real cgminer wire fixtures — the version isn't load-bearing for the claim and would date when fixtures refresh.

Backward compatibility

• All existing rescue CgminerApiClient::ApiError and rescue CgminerApiClient::Error clauses keep working — AccessDeniedError inherits from ApiError, no rescue chain changes needed in cgminer_monitor or cgminer_manager.
• Existing emission sites (wire-side Miner#check_status, local-guard access_denied?) raise the same observable thing (caught by rescue ApiError, message and code symbol unchanged); the only visible difference is that e.is_a?(AccessDeniedError) now returns true for the access-denied path.
• The constructor input-validation changes are loud-on-misuse, not loud-on-existing-callers — the gem's own emission sites all pass valid types. Any external caller passing cgminer_code: "45" or code: 42 was already getting silent or opaque failures; now the failure is loud and actionable.

Test plan

• bundle exec rake green: 251 → 284 examples (+33), rubocop clean
• Coverage holds at 99.7%
• AccessDeniedError is rescued by rescue AccessDeniedError, rescue ApiError, and rescue CgminerApiClient::Error (all three pinned by spec)
• ApiError.for_status(45, ...) returns AccessDeniedError; for_status(14, ...) returns plain ApiError; for_status(999, ...) returns plain ApiError with code: :unknown; for_status('45', ...) coerces the String and returns AccessDeniedError; for_status('not-a-number', ...) falls through to cgminer_code: nil, code: :unknown
• ApiError.new("msg", cgminer_code: "45") raises ArgumentError; same for Float, Hash, Array
• ApiError.new("msg", code: 42) raises ArgumentError; same for Hash, Array, false
• Symbol, String, nil for code: and Integer, nil for cgminer_code: continue to work (regression guard)
• Forward-rot precondition: CgminerApiClient::ApiError::CGMINER_CODES has no key 23
• Wire-side integration spec via FakeCgminer: query(:totally_fake_command) raises ApiError with cgminer_code: 14, code: :invalid_command; query(:privileged) against PRIVILEGED_DENIED raises AccessDeniedError with cgminer_code: 45, code: :access_denied