Clarify scope of "redact certain errors" TODOs in history Nexus handler

Summary

service/history/handler.go has two TODO comments (lines 2523
and 2588) noting that certain errors should be redacted before
being returned:

// TODO: redact certain errors
return nil, err

This occurs in StartNexusOperation and CancelNexusOperation,
in the fallback path when err is not a *nexus.OperationError.

Investigation

service/history/handler.go implements historyservice.HistoryServiceServer,
which is the internal gRPC service between frontend and history —
not the externally-facing Nexus endpoint.

I checked service/frontend/nexus_handler.go, which appears to
already redact unexpected errors before returning to external
Nexus callers:

oc.logger.Error("error converting Nexus failure to Nexus HandlerError", 
    tag.Error(err), ...)
return nil, nexus.NewHandlerErrorf(nexus.HandlerErrorTypeInternal, "internal error")

Question for the team

Given that frontend already redacts errors before they reach
external callers, is the history-layer TODO about:

1. Defense-in-depth — redacting at the history layer too,
   in case frontend's redaction is bypassed or incomplete, or
2. A specific code path where history's response could reach
   external callers directly without going through frontend's
   redaction logic?

If (1), the fix would follow the same pattern as frontend —
catching unexpected errors and returning
nexus.NewHandlerErrorf(nexus.HandlerErrorTypeInternal, "internal error")
while logging the original error server-side.

If (2), I'd need guidance on which code path that is to ensure
the fix covers the actual gap.

Happy to implement once the intended scope is clarified.

References

• service/history/handler.go:2523 (StartNexusOperation)
• service/history/handler.go:2588 (CancelNexusOperation)
• service/frontend/nexus_handler.go:467-472 (existing redaction pattern)

Start with the TODOs in service/history/handler.go at lines 2523 and 2588, then compare the existing handling in service/frontend/nexus_handler.go at lines 467-472. Trace whether history responses can reach external Nexus callers without frontend redaction. Done means the team has confirmed the intended scope and identified the specific path and behavior to implement.