Keep Forge UI available when provider startup fails

[wesm]

Summary

Forge is an offline snapshot of provider data. Before this change, a GitHub token or identity lookup failure during startup terminated the daemon. The daemon then entered a restart loop, so the local snapshot was unavailable whenever GitHub was unavailable.

Provider startup is now best-effort when sync is enabled:

flowchart LR
    A[GitHub unavailable] --> B[Provider bootstrap fails]
    B --> C[Serve cached SQLite snapshot]
    C -. restart after recovery .-> D[Provider sync resumes]

Loading

The UI stays available with the last successful snapshot. Provider-backed reads and writes remain unavailable until the provider can be initialized again. Explicit no-sync startup errors remain fatal.

Verification

• Added a regression test for provider identity/API failure during startup.
• The full short Go suite, lint, and repository hooks pass on the branch.
• With GitHub identity requests returning 503, the daemon stayed running and the documented dashboard route returned HTTP 200.

[roborev-ci]

roborev: Combined Review (ff57ab1)

Degraded startup preserves the UI, but provider failure isolation and sync gating need correction.

Medium

• cmd/kenn-forge/main.go:543, cmd/kenn-forge/provider_startup.go:319 — One provider’s credential or identity failure discards every provider, stopping sync for otherwise healthy hosts. Isolate failures per provider host, retain successfully initialized providers, and add mixed healthy/failing provider coverage.

• cmd/kenn-forge/main.go:579 — Degraded startup leaves sync enabled, allowing periodic and manual sync against an empty registry instead of reporting sync unavailable. Return degraded state from startup, gate background and notification sync, and test degraded server behavior.

---

Reviewers: 2 done | Synthesis: codex, 6s | Total: 4m33s