Make Sources health fail closed

[FZ2000]

Effect in one sentence

Makes Sources health fail closed: a current ingestion error always outranks retained success, so old healthy rows and watcher state cannot look current.

State contract

Retained snapshot	Current error	Presentation
No	No	Loading
Yes	No	Connected source/watcher details
Either	Yes	Source health unavailable; retained rows hidden

What changes

• SourcesPresentationState gives the current request result precedence.
• DashboardStore.refreshIngestion() owns an independent refresh/error/freshness lane.
• Full refresh still starts lanes concurrently; Sources retry does not refresh receipts, plan, or usage.
• Cancellation is not published as a source-health failure.
• The top bar shows source-specific freshness while Sources is active.
• Four deterministic light/dark minimum/reference images cover retained-data failure without leaking local paths.

Latest main compatibility

Current main 7f43eec is merged at head 64edd99.

The resolution preserves main's Observation environment wiring, setup/session-step additions, normal cancellation semantics, and current visual-suite inventory while keeping the Sources-specific refresh lane and fail-closed precedence intact.

Review order

1. Sources presentation state and semantic tests.
2. Dashboard store/top-bar refresh ownership.
3. Sources unavailable state, explanation, and Retry.
4. Sources harness and the four canonical retained-error references.

Verification at current head 64edd99

• Full Swift suite: passed with the expected opt-in visual-test skips and no failures.
• Canonical Setup and Sources visual suites: recorded as needed and verified on the pinned renderer.
• Release build: passed.
• Effective diff against current main: 14 Sources-focused source, test, documentation, and reference files.
• No unresolved index entries or conflict markers; git diff --check is clean.

Fresh GitHub CI is running for this head.

Scope

This changes source-health presentation and refresh isolation only. The pre-existing minimum-width truncation of long verifier descriptions remains out of scope. No PR is merged by this update.