refactor(secrets): pair Vault credential failure logs and metrics

[chet]

Vault credential failures incremented carbide_api_vault_requests_failed_total and then wrote a separate diagnostic for the same request outcome.

Four credential-specific sibling Events now own those paired signals while preserving each historical log level, message, and context shape. The existing metric-only VaultRequestFailed continues to cover service-account and certificate failures, and the frozen request/status labels remain unchanged.

A table-driven test covers all six failure shapes without adding irrelevant empty context to any operation.

Related issues

• This supports Unify Vault request failure logs and metrics #3735
• Part of Unify logging and metrics behind a single instrumentation standard #3169

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

The six failure shapes share a check_values table that asserts the returned status, counter delta, and complete log observation for each request type.

Verified with:

• cargo test -p carbide-secrets (49 passed)
• cargo make format-nightly
• cargo make clippy
• cargo make carbide-lints
• cargo make check-event-names
• cargo xtask check-metric-docs

Additional Notes

CodeRabbit suggested adding credential_key to set/delete failures. That would expand their historical log schemas, so this compatibility pass deliberately leaves those fields out; the rationale is also recorded in the PR conversation.

Closes #3735