fix(sync): the background whole-store sync must not log a download it never stored

[MichaelTaylor3d]

What this changes

Closes #341.

The background whole-store sync path emits info!("whole-store sync downloaded a capsule")
before the chain-anchored verification, the provenance marker, and the atomic write. Every one of
those can refuse, and the background caller (sync_module) maps the resulting Err to a bare false
with no line of its own — so on a headless node the only log evidence of a sync that stored nothing
is a line saying it downloaded a capsule.

Observed on a real two-host EC2 run (mvp4-20260824-160219, v0.145.0 from the released .deb).

Blast radius checked

gitnexus indexes for this repo are ~300 commits stale (CLAUDE.md §2.0 records that a stale index returns
a false-safe impactedCount: 0), so the radius was taken by grep + direct read and is stated as such.

• sync_module_from callers: sync_module (lib.rs:2410) and in-crate tests only. No cross-crate caller.
• The edited log statements have no callers; the behaviour change is confined to emitted records.
• No excluded file is touched (mirror/*, spend_audit.rs, server.rs, download.rs, dispatch.rs,
  content_serve.rs, peer.rs, admission.rs, conduct.rs, dig-wallet/src/sage/* all untouched).

Status

DRAFT — the gate round has not returned.

Evidence

Two tests read a scoped capturing subscriber's REAL emitted records — not that the failure path is
reachable, which was never the defect. test result: ok. 2 passed; 0 failed (count read, not exit status).

Each part proven load-bearing by reverting only that part on a committed tree:

reverted	outcome
the pre-store wording alone	1 passed; 1 failed
the warn! and the "stored" wording	0 passed; 2 failed

The fixture makes the download genuinely SUCCEED and the chain disagree, because a wire failure would
never reach the log statement at all — that is the shape actually observed on the EC2 run.

The control test (a_background_sync_that_stored_a_capsule_says_so) exists to reject the wrong fix:
deleting the line would satisfy every negative assertion while removing the operator's only
confirmation that a capsule is resident.

Stated rather than implied: the full dig-node-core lib run was 1006 passed; 26 failed, and all
26 failed with Io(Os { code: 112, kind: StorageFull }) from the fixture compiler — the dev machine is
at 3.4 GB free of 1.9 TB. Unrelated to this diff and not reproducible until disk is reclaimed.

[MichaelTaylor3d]

Re-ran the full suite on the reclaimed disk: test result: ok. 1032 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out (503s).

This supersedes the 1006 passed; 26 failed reading recorded above. Every one of those 26 failed with
Io(Os { code: 112, kind: StorageFull }) from the fixture compiler, on a machine at 3.4 GB free — none
of them touched this diff. Recording the clean number rather than leaving the caveated one, since a
reader who finds the earlier comment first would otherwise inherit a false red.