#25 tests: assert the refresh_failed observation the comment promised

Follow-up to #24, from its review.

That PR's test comment says the engine "writes a refresh_failed observation here that no direct store call produces" — and that was the stated reason the test had to run the engine instead of reproducing its outcome. Nothing checked it.

A claim in prose with no assertion behind it is the same defect as a guard whose coverage is invisible from its green result. The test passed, the comment read as a guarantee, and deleting the observation outright would have kept it passing.

Why the detail matters as much as the row

The audit chain's entry at this point is a generic invalidate. It cannot distinguish a terminal invalid_grant from a transient transport failure, and only the terminal one latches. So this row is the only place that records that a provider was reached and what it answered.

Which makes a refresh_failed carrying the wrong detail worse than an absent one — it reads as diagnosed.

Both cases mutation-proved

The reviewer named removal; misclassification is the same hole and is covered too.

observation -> None            count drops to 0; failure prints the surviving
                               consumer_report_stale row

detail -> hardcoded "transport" row stays, fails on the detail instead — the arm
                               a count assertion alone would not catch

restored                        green

Verification

bash scripts/gate.sh exit 0, nine real-daemon e2e arms executing.

Pinned at subconscious 572e247d. Master's lock moved to subc-core 0.13.0 while this was in flight — 989ddb27 (which #24 was gated against) no longer resolves. The wire crates did not move with it:

989ddb27   core 0.12.0   proto 0.14.0   transport 0.5.1
44e03c27   core 0.13.0   proto 0.14.0   transport 0.5.1
572e247d   core 0.13.0   proto 0.14.0   transport 0.5.1

subc-core reaches this crate through dev-dependencies only (cargo tree -e normal gives zero hits), so the moving version never enters the shipped binary.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Adds assertions to the refresh-failed test so the engine's promised refresh_failed observation is actually verified. Previously the test passed even if that observation was removed or misclassified; now it checks that exactly one row is written, with the correct credential ID and a detail of invalid_grant.