fix: close build and fetch spans on their error paths

[jaronoff97]

Closes #100. Stacked on #99, so it targets that branch. Retarget to master once #99 merges.

The problem

buildIndex starts a span and only terminates it on success:

var span = bus.started(.info, started_event);

if (policies_slice.len > max_policies) return error.TooManyPolicies;  // span left open
for (policies_slice, 0..) |*policy, i| {
    try builder.processPolicy(policy, @intCast(i));                   // same
}
var index = try builder.finish();                                     // same

span.completed(completed_event);

Three ways out leave the span dangling. This is pre-existing and was identical in all three of the old per-signal build functions. #99 factored those into one function, which is why this is now a single-site fix.

HttpProvider.fetchAndNotify has the other half of the problem. It uses defer span.completed(...), so the span always closes, but a failed fetch is reported as an ordinary completion.

Neither site could do better, because SpanGuard had only completed and done. There was no way to say the span ended badly.

The fix

SpanGuard.failed(err) records the error name and emits at .err, so a failure stays visible even when the span itself is a debug span.

The first terminator wins. The guard now tracks whether it has been terminated, and later terminators no-op. That makes the natural pairing safe:

defer span.completed(fetch_completed);   // registered first, runs last
errdefer |err| span.failed(err);         // registered second, runs first

On the error path the failure is recorded and the completion that follows is a no-op. On the success path only the completion runs. Without the flag this pairing would emit two contradictory terminations.

Both span sites now use errdefer |err| span.failed(err).

Scope

A sweep of started( across src/ found exactly two call sites, both fixed here. No other span has this gap.

Tests

• A failed span emits the error name and the elapsed time.
• The first terminator wins: after failed, a following completed and done emit nothing.

Verification

• zig build test -Doptimize=ReleaseSafe passes.
• Zig 0.16.0 on macOS arm64.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Would Approve

Macroscope's review found this PR approvable — This is a focused observability bug fix that closes existing build and fetch spans on errors without changing successful processing behavior. The implementation is localized and includes tests for failure reporting and duplicate termination prevention.

Not approved because:

• Monthly spending limit reached (workspace setting). Approvability relies on correctness review in order to determine eligibility

No code changes detected at 502efcc. Prior analysis still applies.

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

The merge-base changed after approval.