fix(toolkit-lib): warn when hook failure detail can't be fetched

[mrgrain]

Fixes #1923

If your deploy role doesn't have cloudformation:ListHookResults / cloudformation:GetHookResult (common for custom CDK Pipelines deploy roles or hand-rolled least-privilege roles), a failed CloudFormation Hook used to give you no indication that more detail existed — the lookup failed silently and only showed up in --debug logs. You'd see the exact same generic message whether the hook truly had nothing more to say, or the CLI just couldn't ask.

Before

❌  Deployment failed: Error: The stack named MyStack failed creation, it may need to be manually deleted.

Change set creation failed. The following hook(s) failed: [Example::CFNHook::Full]

(No hint that more detail exists. The real reason is buried in --debug output.)

After

❌  Deployment failed: Error: The stack named MyStack failed creation, it may need to be manually deleted.

Change set creation failed. The following hook(s) failed: [Example::CFNHook::Full]

   Could not fetch extra hook failure detail for change set cdk-deploy-change-set (User: arn:aws:sts::123456789012:assumed-role/cdk-pipeline-deploy-role/example-runner is not authorized to perform: cloudformation:ListHookResults ...). Run again with -v to see the full error.

The warning is attached to the reported error itself and rendered right after the failure message, so you know it's worth investigating instead of assuming the hook had nothing more to say. The full underlying error is available with -v.

This applies both to ListHookResults (used by cdk deploy and cdk diagnose to find hooks that failed a change set) and GetHookResult (used to fetch a hook's detailed failure reason, e.g. Guard Hook annotations).

What was tested

Updated and added unit tests in stack-diagnoser.test.ts and stack-activity-monitor.test.ts covering the warning being attached on fetch failure. Full toolkit-lib test suite (134 suites, 2031 tests) and lint pass.

Checklist

• This change contains a major version upgrade for a dependency and I confirm all breaking changes are addressed
  • Release notes for the new version:

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None