test(web-network): check the manifest refusal text like the api-surface refusal

The real-capture verifier stringified the whole MCP result for the
environment-manifest refusal, so a declared "[" literal matched the result
envelope itself; compare the parsed refusal as the api-surface branch does.

Refs morluto/rea#4933

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

scripts/verify-web-network-captures.mjs

@@ -945,8 +945,9 @@ async function inspect(mode, input, errorCategory) {
       });
       if ((input.sensitive_values ?? []).length > 0) {
         assert.equal(manifest.isError, true);
+        const refusedManifest = JSON.parse(mcpTextValue(manifest));
         for (const literal of input.sensitive_values)
-          assert.ok(!JSON.stringify(manifest).includes(literal));
+          assert.ok(!JSON.stringify(refusedManifest).includes(literal));
       } else {
         assert.notEqual(manifest.isError, true, mcpTextValue(manifest));
         const projected = JSON.parse(mcpTextValue(manifest));