:bug: a stage whose handoff records Status: failed still reports stage succeeded

A stage whose own handoff artifact records a failure still reports success, so a workflow carries on
from a stage that did nothing.

Ran a two-stage plan/execute workflow where the plan stage produced no commit, so `docs/plan.md` did
not reach the execute stage. The execute skill correctly refused, wrote its failure into the handoff
and committed that:

```
## Execute
- Status: failed

| Step | File | Action | Result | Error |
|------|------|--------|--------|-------|
| - | - | - | failed | docs/plan.md not found |
```

The harness then logged `[ok] stage succeeded`, the AgentRun went `Succeeded`, and the
AgentWorkflowRun reported `Succeeded` overall. The commit is real, so `Push` had something to push
and the branch landed - it just contains a record of not having done the work.

`Status:` in the handoff is machine readable and nothing reads it. I think the workflow should treat
a stage whose handoff reports `failed` as a failed stage, or at least not report the run Succeeded,
otherwise the only way to notice is reading the artifact by hand.

Related but not the same as #231 (closed) and #232: there the model call was rejected by the
provider. Here the model worked fine and the stage genuinely failed at its task.

Start by running the described two-stage plan/execute workflow and inspect how the handoff artifact's `Status: failed` is handled by the harness. Trace how that result propagates to the AgentRun and AgentWorkflowRun status, then verify that a failed stage no longer produces `[ok] stage succeeded` or an overall Succeeded result.

Written by the indexing model from the issue text.