Function classify_error_message 

pub fn classify_error_message(msg: &str) -> ErrorCategory

Classify an error message string into an ErrorCategory.

Marker groups are checked in priority order to handle overlapping patterns (e.g., “tool permission denied by policy” → PolicyViolation, not PermissionDenied).