agentHost: cover the rejected-RPC path of the script-safety fail-closed guard

`session.options.update` reports `success: true` for any patch the runtime
accepts and signals real problems by failing the request, so a rejected RPC —
not a `success: false` body — is the path a genuine enablement failure takes.
Both existing fail-closed tests drove the `success: false` branch, leaving the
`catch` that logs the reason and aborts the launch uncovered.

Adds a test that rejects the update and asserts the launch fails closed, the
original error propagates, and the orphaned session is disconnected.

Also drops the managed rules from the success test. They no longer gate the
behavior, so passing a `deny` rule implied a dependency that is exactly the one
the fail-closed change removed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: joshspicer

src/vs/platform/agentHost/test/node/copilotSessionLauncher.test.ts

@@ -884,9 +884,10 @@ suite('CopilotSessionLauncher GPT-5.6 customizations', () => {
 			disconnect: async () => { },
 			rpc: { options: { update: async (options: unknown) => { updates.push(options); return { success: true }; } } },
 		} as unknown as CopilotSession;
-		// Enablement is required for every session, so anything short of success would
-		// fail the launch — the success path is what is asserted here.
-		const launcher = createTestLauncher({ deny: ['Shell(rm -rf *)'] });
+		// Enablement is required for every session regardless of managed rules, so
+		// anything short of success would fail the launch — the success path is what
+		// is asserted here.
+		const launcher = createTestLauncher();
 		const plan: CopilotSessionLaunchPlan = {
 			kind: 'create',
 			client: { createSession: async () => session } as unknown as CopilotClient,
@@ -966,6 +967,36 @@ suite('CopilotSessionLauncher GPT-5.6 customizations', () => {
 		await launcher.disposeByokProxyHandle();
 	});
 
+	// The runtime reports success for any patch it accepts and signals real problems by
+	// failing the request, so a rejected RPC — not a `success: false` body — is the path
+	// a genuine enablement failure takes.
+	test('fails the launch closed and disconnects when the script safety request itself fails', async () => {
+		let disconnected = false;
+		const session = {
+			sessionId: 'session-1',
+			on: () => () => { },
+			disconnect: async () => { disconnected = true; },
+			rpc: { options: { update: async () => { throw new Error('connection closed'); } } },
+		} as unknown as CopilotSession;
+		const launcher = createTestLauncher();
+		const plan: CopilotSessionLaunchPlan = {
+			kind: 'create',
+			client: { createSession: async () => session } as unknown as CopilotClient,
+			sessionId: 'session-1',
+			workingDirectory: testWorkingDirectory,
+			resolvedAgentName: undefined,
+			snapshot: { tools: [], plugins: [], mcpServers: {} },
+			activeClientToolSet: new ActiveClientToolSet(),
+			shellManager: undefined,
+			githubToken: undefined,
+			model: { id: 'claude-sonnet-4.5', config: {} },
+		};
+
+		await assert.rejects(() => launcher.launch(plan, testRuntime), /connection closed/);
+		assert.strictEqual(disconnected, true, 'expected the orphaned session to be disconnected');
+		await launcher.disposeByokProxyHandle();
+	});
+
 	test('applies GPT-5.6 customizations when resuming an existing session', async () => {
 		const updates: unknown[] = [];
 		const session = {