Fallback observability: emit redacted ores-otel source-transition events #394

Concrete child task of transport ownership #331, exercised by #388.

Add structured CLI-level observability for source transitions without reimplementing HTTP details owned by zed-clients.

Acceptance criteria:

• emit events for primary registry attempt, GitHub Release, GHCR, GitHub tag archive, optional mirror/R2, success, and terminal failure;
• include package coordinate, immutable revision/digest when known, typed reason category, elapsed time, and source kind;
• never include tokens, Authorization/Cookie headers, signed query strings, or raw response bodies;
• transport-specific fields originate from typed zed-clients outcomes;
• tests assert redaction and event ordering for registry-down GitHub-only recovery;
• logging remains functional when ores-otel export is unavailable.