fix: preserve platform builder failure diagnostics

platform/service/distribution_builder.go

@@ -297,7 +297,7 @@ func (builder *DockerDistributionBuilder) BuildWithProgress(input domain.Distrib
 		if errors.Is(ctx.Err(), context.DeadlineExceeded) {
 			return nil, validationError("platform builder timed out while building the distribution")
 		}
-		return nil, validationError("platform builder failed: " + safeBuilderFailure(output, input.AuthKey, builder.config.SourceDir, sourceDir, jobDir))
+		return nil, validationError("platform builder failed: " + safeBuilderFailureWithCommandError(output, err, input.AuthKey, builder.config.SourceDir, sourceDir, jobDir))
 	}
 	reportBuilderProgress(progress, 92, "package_finalize: reading platform builder output")
 	binary, err := os.ReadFile(filepath.Join(outputDir, outputName))
@@ -678,6 +678,14 @@ func safeBuilderFailure(output []byte, sensitiveValues ...string) string {
 	return joined
 }
 
+func safeBuilderFailureWithCommandError(output []byte, commandErr error, sensitiveValues ...string) string {
+	message := safeBuilderFailure(output, sensitiveValues...)
+	if commandErr == nil || !strings.HasPrefix(message, "build command reported no ") {
+		return message
+	}
+	return safeBuilderFailure([]byte(commandErr.Error()), sensitiveValues...)
+}
+
 func redactBuilderHostPaths(line string) string {
 	fields := strings.Fields(line)
 	for index, field := range fields {

platform/service/distribution_builder_test.go

@@ -364,6 +364,18 @@ func TestDockerDistributionBuilderRedactsFailureAndTimeout(t *testing.T) {
 	}
 }
 
+func TestSafeBuilderFailureFallsBackToCommandError(t *testing.T) {
+	secret := "sensitive-component-key"
+	message := safeBuilderFailureWithCommandError(
+		[]byte("__platform_builder_progress__|72|build_compile: compiling run target executable\n"),
+		errors.New("exit status 1: failed to start container with "+secret+" /private/platform/build"),
+		secret,
+	)
+	if message != "exit status 1: failed to start container with [redacted] [redacted-path]" {
+		t.Fatalf("unexpected command error fallback: %q", message)
+	}
+}
+
 func TestBuilderJobFailureMessageRedactsSensitiveValuesAndHostPaths(t *testing.T) {
 	const secret = "sensitive-component-key"
 	message := builderJobFailureMessage(errors.New(secret+" /private/platform/build/input/auth-key"), secret)