Add machine-readable fallback decision trace with secret-free source reasons #397

Follow-up to #388, #392-#394, and transport ownership #331.

Operators need to understand why a package used Release, GHCR, tag reconstruction, an explicit mirror, or failed without scraping human stderr.

Acceptance criteria:

• add a versioned machine-readable decision trace/report for one install/fetch operation;
• every attempted source has stable source kind, typed outcome/reason code, elapsed time, immutable package identity, and whether it was selected;
• transport details are consumed from typed zed-clients outcomes; CLI does not parse raw HTTP;
• no tokens, cookies, Authorization headers, signed query strings, local ambient paths, or raw response bodies;
• deterministic ordering and bounded record count;
• available as structured ores-otel evidence and an explicit JSON output/debug surface without contaminating normal stdout protocols;
• fixtures cover registry-down success, all-sources-down failure, REST-degraded smart-HTTP recovery, and fallback-disabled refusal.