Surface readTreehash errors instead of swallowing

[sbalabanov]

Summary

readTreehash collapsed two very different cases — a legitimate cache miss (treehash not yet computed) and a real infra failure (e.g. storage backend rejecting a missing-TTL request) — into the same return value: "". Callers couldn't distinguish them, so an outage that disabled the cache showed up only as silent recomputation, visible only by tailing logs.

Changes

1. readTreehash now returns (string, error):

   • NotFound → ("", nil): the expected miss, callers fall through to recompute
   • any other failure → ("", err): wrapped with the storage key for context
   • success → (treehash, nil)

2. Pre-cache lookup in GetChangedTargets surfaces the error as a request failure tagged failureReasonTreehashRead / ErrorTypeInfra. Storage breakage now becomes a visible request-level failure rather than silent degradation, so dashboards and on-call alerts can see it.

3. Cache-write goroutine can't return synchronously, so it logs at Error level (was Warn) and abandons the write. The cache opportunity is lost but the failure stays loud.

4. New failureReasonTreehashRead failure-reason constant for metric tagging.

Tests

• TestReadTreehash covers the four signature outcomes: NotFound miss, generic storage error, nil response, success.
• TestGetChangedTargets_TreehashReadError replaces the old GetGraphError test (which only "worked" because errors were swallowed and the request still reached graph fetch) and asserts the request fails with the new failureReasonTreehashRead classification.

Test plan

• `go build ./...`
• `go test ./controller/...`
• `./tools/bazel test //controller/...`
• CI green

Stacking

Based on `fix-cache-goroutine-ctx` (#115). Merge order: #115 first, then this. Once #115 lands, this PR's base should be retargeted to `main`.

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}