fix(storage): expose integrity source failures

Include the first accepted-clone fetch failure in the terminal family integrity error. Production repair attempts previously logged only a count, which made an unresolved family impossible to diagnose at info-level deployments.\n\nThe existing aggregate counts and bounded family diagnostics remain unchanged; this deliberately does not add per-source success logging or alter repair behavior. Accepted clone URLs are public announcement data and the hardened fetch path does not attach ambient credentials.\n\nValidated with cargo fmt --check, strict all-target Clippy, and the eight git::integrity unit tests.

src/git/integrity.rs

@@ -303,6 +303,11 @@ async fn run_one_family<S: FamilyRepairSource + ?Sized>(
         .first()
         .map(String::as_str)
         .unwrap_or("");
+    let source_failure = outcome
+        .source_failures
+        .first()
+        .map(String::as_str)
+        .unwrap_or("");
     error!(
         identifier = %key.identifier,
         object_format = %key.object_format,
@@ -318,6 +323,7 @@ async fn run_one_family<S: FamilyRepairSource + ?Sized>(
         diagnostic,
         sources_tried = outcome.sources_tried.len(),
         source_failures = outcome.source_failures.len(),
+        source_failure,
         "Git identifier family remains unhealthy after integrity check"
     );
 }