fix(OMN-16998): terminal_failure_cause names the observed provider status class

[Patel230]

Closes OMN-16998 (core half).

EnumDelegationTerminalFailureCause carried exactly ONE member, PROVIDER_QUOTA_EXHAUSTED. So a live HTTP 401 had no cause it could resolve to and was recorded as a quota event — an auth failure wearing the quota label. The over-quota refusal metric is measured from this field, so that overstates capacity pressure that never happened.

What this adds

• AUTH_FAILED — the provider rejected the credential: HTTP 401 or 403. Never capacity.
• PROVIDER_ERROR — any other provider-side failure, once one has been observed. Deliberately distinct from a null cause: an unobserved failure and an unrecognised one are not the same fact.

Purely additive. No existing member renamed, no wire value changed.

Tests

10 new, in tests/unit/enums/test_enum_delegation_terminal_failure_cause.py:

• Each member's wire string is pinned to an exact value and asserted to round-trip from it. These cross a process boundary into the terminal payload, so a rename is a breaking contract change and must fail here first.
• The vocabulary is asserted to be exactly the pinned set. This guards the direction the parametrized tests cannot: they prove every expected member is present, this proves no unexpected one is.
• The three causes are mutually distinct. If any two ever compare equal, the defect this ticket exists to remove becomes unobservable.
• An unrecognised wire value raises rather than coercing to the nearest label — a terminal carrying a cause this build cannot express must surface as an error, not silently degrade.

Version

No bump in this diff. dev reached 0.47.2 independently while this branch waited, and PyPI is still at 0.47.1 — so 0.47.2 is unreleased and this change lands inside that pending release. The OMN-13411 release-identity gate is satisfied by the bump already on dev.

Governed pre-push on .201. No PREPUSH_* override, no --no-verify, no skip token, no override grant.

selection: is_full_suite=True reason=shared_module paths=[ tests/ ] (feature-flag=on)
44464 passed, 56 skipped, 3 xpassed in 10678.17s (2:57:58)
[prepush-smart-tests] impacted tests passed; allowing push.

Zero failures. An earlier run of this branch reported 4 failed / 44448 passed. Two were test_verify_flip_bundle twin-baseline-shrink, since root-caused and fixed as OMN-17324 (a sibling clone owned by another uid, refused by git safe.directory). Two were the load-dependent test_cli_stdout_parity split_count 39-vs-40 cases, which pass on a quiet box — this run confirms that.

Selector note for OMN-16321

This diff is two files — the enum and its test — purely additive, with no pyproject.toml or uv.lock change. It still escalates with reason=shared_module.

That rules out the hypothesis raised when this branch first escalated, that the version bump riding in the same commit might be the disqualifier. The bump became a no-op after the rebase and the escalation is unchanged, so enums/ being a shared module is sufficient on its own.

Not in this PR

The omnimarket half — the resolve_terminal_failure_cause rewrite, where status and quota body must corroborate within one reported failure — is committed and held until this lands and the infra pin advances.

The live-401 done-proof (wrong key → one delegation → terminal_failure_cause == "auth_failed" while quality_gates_failed[0] contains HTTP 401) needs the .201 lane, which is currently blocked on OMN-17150 defect 3: the runtime cannot find a Bifrost lane overlay of its own.

Evidence-Ticket: OMN-16998
Evidence-Source: OCC#7923

[Patel230]

Close-out for OMN-16998. Jonah merged this as 4edb9e59 on dev at 2026-09-01T03:56:23Z. There were no review comments.

What landed: AUTH_FAILED and PROVIDER_ERROR were added to EnumDelegationTerminalFailureCause next to PROVIDER_QUOTA_EXHAUSTED, with 10 tests in tests/unit/enums/test_enum_delegation_terminal_failure_cause.py. It ships in v0.47.2: that tag contains 4edb9e59, and v0.47.1 does not.

How it was verified:

• CI run 33465979014 passed on head 96878986. Of 183 checks, 179 passed, 2 were skipped and 2 failed.
• The two failures were occ-preflight / eligibility jobs (job 99725816650, job 99725816613), both refused with "PR body is missing required 'Evidence-Source:' line". They ran at 03:22:57Z, 30 seconds after the PR opened and while OCC#7923 was only being created. The other 30 eligibility runs on the same head all passed.
• The governed pre-push on .201 ran the full suite: 44464 passed, 0 failed.

One correction to the description. The selector note says enums/ being a shared module is enough by itself to escalate the push to the full suite. That is wrong. The OMN-16321 additivity check was already on dev. This diff did not qualify for it because I rewrote the class docstring and added a docstring to PROVIDER_QUOTA_EXHAUSTED, and those non-member edits are what caused the escalation. The correction is also on the ticket.

The consumer half is omnimarket#2287. The live check that a 401 comes back as auth_failed ran on 2026-09-23 and is recorded on the ticket.

Thank you!