fix(runner): only fail a run on denied write tools with a worktree

src/ClaudeDo.Worker/Runner/TaskRunner.cs

@@ -496,13 +496,18 @@ public sealed class TaskRunner
         // downgrade to interactive "default" (see PermissionModeResolver). Left alone this
         // lands as a normal WaitingForReview with an empty diff, and a reviewer sees only
         // that emptiness with no clue why. Surface it as a failure instead.
-        if (!committed && result.PermissionDenials.Count > 0)
+        //
+        // Narrow on purpose. It only fires when a worktree exists (a sandbox run has no diff
+        // whose emptiness could mean anything) and only for denied WRITE tools: a research task
+        // that legitimately changes nothing, or one that had a single Bash call denied, is a
+        // successful run and must not be reported as "all edits blocked".
+        var deniedWrites = result.PermissionDenials.Where(IsWriteTool).Distinct().ToList();
+        if (wtCtx is not null && !committed && deniedWrites.Count > 0)
         {
-            var tools = string.Join(", ", result.PermissionDenials.Distinct());
             await MarkFailed(
                 task.Id, task.Title, slot,
-                $"All edits were blocked by permission denials ({tools}) and nothing was changed. " +
-                "Check the run's permission mode (get_effective_run_config).",
+                $"All edits were blocked by permission denials ({string.Join(", ", deniedWrites)}) and nothing " +
+                "was changed. Check the run's permission mode (get_effective_run_config).",
                 result.TurnCount);
             return;
         }
@@ -578,6 +583,15 @@ public sealed class TaskRunner
         }
     }
 
+    // Tools whose denial means the run could not change files. Everything else (Bash, WebFetch,
+    // an MCP tool, …) can be denied in a perfectly successful run, so it must not mark one failed.
+    private static readonly HashSet<string> WriteTools = new(StringComparer.OrdinalIgnoreCase)
+    {
+        "Edit", "Write", "MultiEdit", "NotebookEdit", "Update",
+    };
+
+    internal static bool IsWriteTool(string toolName) => WriteTools.Contains(toolName);
+
     /// <summary>Classifies the CLI's raw <c>terminal_reason</c> into the small, MCP-facing enum
     /// (<c>max_turns|timeout|error</c>) get_task/batch_get_tasks report as failureReason.
     /// "cancelled" is set explicitly at the call sites that know it (there's no CLI signal for it).</summary>