Fleet Sweeps shows "no sweeps" when the store read fails

Found by the round-1 security review of #4293 (finding H3). It is older than #4293 and outside its diff.

What happens

The Fleet Sweeps page shows a clean empty answer when its store read fails.

/api/sweeps (DarlingFleetSweepEndpoints.cs near :168-184) and /api/sweeps/watch-items (near :214-229) call GetSweepsBySpanAsync, GetOpenAndCarriedWatchItemsAsync and GetWatchItemsByStateAsync.
Each read catches a store fault, logs it and returns an empty list (Darling/PerformanceMonitor.Darling.Storage/FleetSweepStore.cs near :860-865, :1013-1018 and :982-987).
The route answers 200 {"sweeps": []}, and sweeps.js (near :299-303) shows "No sweeps in this span. Widen the span...".
The watch list shows an empty worklist the same way. A sweep document's verdicts and would-have-paged ledger (FleetSweepStore.cs near :914 and :948, through BuildDetailAsync) also come back empty on a fault, so the page shows no verdicts, and with alerts off an empty ledger.

The comment on Map (DarlingFleetSweepEndpoints.cs near :150-153) says nothing here swallows a fault. These reads do.

Give the web feed versions of these reads that throw on a fault. The backstop then answers 500 or 503, and the page shows its error strip.
The engine callers keep the log-and-degrade versions.
For the child reads of a sweep document, add a degraded field and show it as a warning.
Correct the Map comment.

Ruled. Checked against dev at 6a49473. This replaces the fix list in the body.

The engine already has its own throwing reads: GetServerVerdictsForEngineAsync and the daily rollup's span read (FleetSweepStore.cs ~650-700). The five log-and-degrade reads (~833-1018) have no engine callers. Their only callers are the web routes in DarlingFleetSweepEndpoints.cs (~182, ~246-247, ~261-266) and the MCP tool get_sweep_reports (DarlingMcpFleetSweepTools.cs ~129, ~146).
So MCP has the same bug. On a store fault it answers empty, which the MCP contract reserves for a true negative.

The fix:

The five presentation reads stop swallowing faults. Keep one log line per failure, where the caller handles it.
The web routes let the fault reach the existing backstop, so the page shows its error strip. Don't edit DarlingWebEndpoints.cs, because Web viewer: stop sending exception text to the browser on the remaining paths (#4283) #4293 is changing it.
get_sweep_reports answers with the error status on a fault, not empty.
A sweep document whose verdicts or would-have-paged ledger can't be read fails the whole request. No degraded field, because a document without its verdicts isn't a partial answer.
Correct the comment on Map.
Tests: a store fault on each read gives the error answer on both surfaces, never {"sweeps": []} or empty. Prove once that they fail on the old code.

🤖 Generated with Claude Code

Tighten the #4315 fault tests: SqlState, two more routes, a log-line …

Fleet Sweeps reports an error instead of "no sweeps" when its store r…

Closed by the watcher: delivered in PR #4328, merged to dev.

Fixed by #4328, merged to dev (5cdf508).