Capture provider failures in secure debug artifacts

internal/app/profile_execution.go

@@ -2,6 +2,7 @@ package app
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"reflect"
 
@@ -95,6 +96,18 @@ func executePreparedProfile(ctx context.Context, req profileExecutionRequest) (p
 		if callbackFailed {
 			return outcome, nil, &profileExecutionError{operation: "execute prompt", err: err, callbackFailure: true}
 		}
+		if req.DebugWriter != nil && req.DebugWriter.Enabled() && req.DebugRef != nil {
+			var generationError *promptexec.GenerationError
+			if errors.As(err, &generationError) {
+				path, debugErr := req.DebugWriter.WriteFailure(*req.DebugRef, generationError)
+				if path != "" {
+					outcome.LLMDebugPath = path
+				}
+				if debugErr != nil {
+					err = errors.Join(err, promptDebugWriteError(debugErr))
+				}
+			}
+		}
 		return outcome, nil, &profileExecutionError{operation: "execute prompt", err: classifiedPromptError("prompt execution failed", err)}
 	}
 	if execution == nil {