test(agent-bff): document the deliberate non-string html cast

Author: Tonours

packages/agent-bff/test/action/action-routes-middleware.test.ts

@@ -695,6 +695,8 @@ describe('action execute', () => {
   it('omits details when the action Error html is not a string', async () => {
     const form = makeAction({
       execute: jest.fn(async () => {
+        // The double cast is deliberate: ActionFormValidationError.html is typed string, but the
+        // agent-client builds it from an unchecked JSON cast, so the runtime value can be anything.
         throw new ActionFormValidationError('Refund failed', { evil: 1 } as unknown as string);
       }),
     });