fix(sandbox): surface a SandboxGitError on a malformed git-api response body

[pedrofrxncx]

Source: bug found while auditing apps/web/src/components/thread/github/sandbox-git-api.ts (the Fast Preview / sandbox git plumbing behind usePrDiff and the publish popover) for resilience against network hiccups.

Why a maintainer wants this: fetchGitStatus/fetchGitDiff/publishGitChanges/rebaseGitBranch/fetchSuggestCommitMessage/fetchReviewVerdict/discardGitFiles all funnel through one parseJson() that called res.json() unguarded. A response whose body isn't valid JSON — a proxy's HTML error page, a timeout returning a truncated body — throws a raw SyntaxError instead of the SandboxGitError every caller is written to expect.

Failure scenario: isSandboxUnreachable(error) (used by the status-poll backoff) only recognizes SandboxGitError with status 503/410/404. A malformed-body response from an unreachable sandbox now fails that check — the poller doesn't back off and keeps hitting a dead sandbox every 3s instead of the intended graceful backoff. The regression test in sandbox-git-api.test.ts reproduces this: a 502 with an HTML body now surfaces as SandboxGitError with status: 502 instead of an unrecognized SyntaxError.

Fix: wrap the res.json() read in try/catch inside parseJson; on parse failure, throw SandboxGitError('Request failed (<status>)', status) — the same shape callers already branch on.

Reviewer check: cd apps/web && bun test src/components/thread/github/sandbox-git-api.test.ts

Verified locally: bun run fmt, bunx tsc --noEmit (apps/web), the one targeted test file, bunx oxlint on both changed files — all clean. Full CI validates the rest.

---

Summary by cubic

Surfaces SandboxGitError(status) when the git-api returns a malformed JSON body, restoring consistent error handling and correct backoff. Previously, parseJson called res.json() unguarded, so HTML/truncated bodies threw a raw SyntaxError that callers (e.g., the status poller) could not classify.

• Wraps res.json() in try/catch inside parseJson; on parse failure, throws SandboxGitError("Request failed (<status>)", status).
• Adds a test that a 502 with HTML yields SandboxGitError (status 502) and is not treated as unreachable by isSandboxUnreachable.

Review notes

• Run: cd apps/web && bun test src/components/thread/github/sandbox-git-api.test.ts
• No migration required.

^{Written for commit 58ca40c. Summary will update on new commits.}