Guide the fix for a provider failure where it shows up

[ppXD]

Summary

• A run that fails on a provider connection (credential disconnected or refused, GitLab rejecting a token, an address that redirects, a push the remote refused, a sign-in that could not be renewed) now records a machine-readable failure beside its sentence, and the run detail answers with a remedy computed for the caller: what is wrong in plain language, the credential and repository it names, and which fixes this person may press (Re-link, Reconnect, Replace token, Edit provider address, Open Providers, Re-run) or whom to ask. The page renders it as a remediation card in the warm theme; a refused webhook delivery gets the same card on the repository's delivery history.
• The remedy only offers what the endpoint behind it accepts: reconnecting a sign-in needs credentials.manage (as starting an OAuth connect does), replacing a pasted token needs the credential's own person or credentials.manage, an address edit is offered only when UpdateProviderInstanceCommand would take it (nothing connected through the provider, or an http to https upgrade of the same host), otherwise the sentence says what works.
• The failure is the one the node that ended the run recorded (or that node's agent run); a failure the run handled, or met before it was abandoned, does not speak for it. The git write nodes that word a provider 401 themselves keep the exception beside their sentence, so the 401 is recorded without changing what they say or how they retry.
• A renewal or a standing lookup the provider did not answer blames nobody and sends nobody to repair a credential nobody refused; the refusal row keeps which lookup failed in its existing request metadata column.
• The Providers dialog lists every credential with its health and bound repositories, a repository row says when its credential is not healthy whatever its status, and Re-link offers only the caller's own and the team's credentials. No migration; older rows and older clients render as before.

Test plan

• Unit (full suite, 14707 passed): per-code, per-role action matrix; redirect repair agrees with the update endpoint's own rule; copy per code and per lookup cause; capture of the OAuth error code; wire strings pinned
• Integration (high fidelity, real engine and Postgres, GitLab stub or loopback only): dead OAuth grant, revoked token, disconnected credential, renewal GitLab did not answer, six git write nodes on a 401, redirect repaired through the real update and disconnect commands, handled failure then another failure, abandoned run, agent-run correlation, per-role remedies, masked base URL, standing refusals per cause
• HTTP E2E (high fidelity, real pipeline): the run detail's Reconnect state matches what the OAuth init endpoint answers the credential's own Member; remedy wire shape for an Owner, a Member and a Viewer; old rows unchanged
• Frontend: vitest 2682 passed (card per code and role, repository row Reconnect vs Replace token, no-fault and unrepairable-redirect cards), pnpm lint 0 errors, tsc --noEmit -p tsconfig.app.json, pnpm build
• Staging: reconnect a dead OAuth grant from the run card as an Admin and re-run; confirm a Member owner sees Reconnect under "Not yours to do"