fix(copilot): keep the withheld-result tests out of the secret scanners

The withheld-run fixture was shaped like a live provider key, which is
exactly what a secret scanner is built to catch — it flagged the test file
itself. The value only has to clear the eight-character substitution floor,
so it says what it is instead. The id-shape guard likewise no longer needs
a credential-looking string to prove it refuses one.

Also routes the test's error-message mock through getErrorMessage rather
than reimplementing it inline, which check:utils bans.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/lib/copilot/request/tools/resolved-secret-result.test.ts

@@ -484,7 +484,7 @@ describe('effect disclosure on a withheld result', () => {
         {
           success: false,
           error: 'why',
-          effect: { phase: 'performed', ids: { executionId: 'sk-live-9Qv2XbTn4LmZa8Rd' } },
+          effect: { phase: 'performed', ids: { executionId: 'not-a-server-minted-id' } },
         },
         undefined,
         'run_workflow'

apps/sim/lib/copilot/tools/handlers/workflow/withheld-run-result.test.ts

@@ -11,6 +11,7 @@
  * on its arguments, a call that threw after dispatch, and a run that completed. All three
  * used to arrive as the same sentence.
  */
+import { getErrorMessage } from '@sim/utils/errors'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { inspectToolResultForCopilot } from '@/lib/copilot/request/tools/resolved-secret-result'
 import type { ExecutionContext } from '@/lib/copilot/request/types'
@@ -26,7 +27,7 @@ vi.mock('@/lib/copilot/application/execute-workflow-use-case', () => ({
   executeCopilotWorkflowUseCase: mocks.executeWorkflowUseCase,
   /** Passthrough, so a masked message is visible as masking rather than as a fallback. */
   messageForCopilotWorkflowError: (error: unknown, fallback = 'Workflow operation failed') =>
-    error instanceof Error ? error.message : fallback,
+    getErrorMessage(error, fallback),
 }))
 
 vi.mock('@/lib/workflows/sanitization/json-sanitizer', () => ({
@@ -40,7 +41,9 @@ vi.mock('@/lib/core/telemetry', () => ({
 import { executeRunWorkflow } from '@/lib/copilot/tools/handlers/workflow/mutations'
 
 const EXECUTION_ID = '0f4d5a4c-6a1e-4c2f-9b7d-2c8f1a3e5d90'
-const SECRET = 'sk-live-9Qv2XbTn4LmZa8Rd'
+/** Above the 8-char substitution floor, and deliberately not shaped like any real
+ * provider credential — a realistic-looking fixture makes secret scanners flag this file. */
+const SECRET = 'fake-secret-for-test-only'
 
 const context = {
   userId: 'user-1',