fix(canopy): flatten miette error chain when reporting failures

bestool-canopy's methods return miette::Report; its errors are layered
via .wrap_err() so the outermost message is context (e.g. "posting
restore capabilities to canopy") and the actual reqwest/io error is
inside the source chain. Our wrapper was formatting with {err} which
only shows the outermost message, losing every diagnostic detail.

Walk the .chain() and join with ": " so the log line carries the full
context → cause path. E.g. instead of

  Canopy error: restore_capabilities: posting restore capabilities to canopy

we now get

  Canopy error: restore_capabilities: posting restore capabilities to canopy: <reqwest error>: <underlying io/tls error>

Adds miette 7.6.0 as a direct dep (already transitive via bestool-canopy).

Author: passcod

Cargo.lock

@@ -18,6 +18,7 @@ jiff = { version = "0.2.25", features = ["serde"] }
 k8s-openapi = { version = "0.27.1", features = ["latest", "schemars"] }
 kube = { version = "3.1.0", default-features = false, features = ["runtime", "derive", "client", "rustls-tls", "ws"] }
 kube_quantity = "0.9.0"
+miette = "7.6.0"
 mimalloc = { version = "0.1", default-features = false }
 prometheus = "0.14.0"
 rand = "0.10.1"

Cargo.toml

@@ -103,7 +103,7 @@ impl Client {
 		self.inner
 			.restore_capabilities(&self.base_url, intents)
 			.await
-			.map_err(|err| Error::Canopy(format!("restore_capabilities: {err}")))
+			.map_err(|err| Error::Canopy(format!("restore_capabilities: {}", chain(&err))))
 	}
 
 	/// Fetch the consumer's desired-state worklist. Each entry is one
@@ -112,7 +112,7 @@ impl Client {
 		self.inner
 			.restore_worklist(&self.base_url)
 			.await
-			.map_err(|err| Error::Canopy(format!("restore_worklist: {err}")))
+			.map_err(|err| Error::Canopy(format!("restore_worklist: {}", chain(&err))))
 	}
 
 	/// Fetch short-lived read-only STS creds plus the repo password for a
@@ -127,7 +127,8 @@ impl Client {
 			.await
 			.map_err(|err| {
 				Error::Canopy(format!(
-					"restore_credentials({backup_type}, {group}): {err}"
+					"restore_credentials({backup_type}, {group}): {}",
+					chain(&err)
 				))
 			})
 	}
@@ -137,7 +138,7 @@ impl Client {
 		self.inner
 			.restore_verification(&self.base_url, report)
 			.await
-			.map_err(|err| Error::Canopy(format!("restore_verification: {err}")))
+			.map_err(|err| Error::Canopy(format!("restore_verification: {}", chain(&err))))
 	}
 
 	/// Direct access to the public-mTLS base URL the client is configured
@@ -148,6 +149,19 @@ impl Client {
 	}
 }
 
+/// Flatten a `miette::Report` (bestool-canopy's error type) to a single
+/// `outer: inner: root` line by walking its source chain. bestool wraps
+/// its errors with `.wrap_err(...)` which layers context around the
+/// underlying reqwest / io error, and plain `Display` on the report
+/// only shows the outermost message — losing the actually diagnostic
+/// bit.
+fn chain(err: &miette::Report) -> String {
+	err.chain()
+		.map(|e| e.to_string())
+		.collect::<Vec<_>>()
+		.join(": ")
+}
+
 /// Re-export the wire types pgro consumes verbatim from `bestool-canopy`.
 pub use bestool_canopy::{
 	BackupCredentials as Credentials, Outcome, RestoreCredentials as CredsResponse,