sync: report identifying config context on success and failure

[Odilhao]

Summary

When sync fails partway through, the failure could not be traced back to the config entry that caused it, and neither report format confirmed which config file was even in play.

• RepoResult/RepoEvent now carry the group name a repo belongs to, so same-named repos in different groups are distinguishable in a run's results.
• The human-readable report's FAIL line now prints path and group, matching what the OK line already showed.
• The live-progress line printed during a run now shows the actual error text on failure, not just the outcome word.
• Identity/signing validation errors (e.g. a typo'd signing_method) are now wrapped with repo name, path, and group, so they're traceable without hand-bisecting the TOML.
• Both report formats now state the resolved config file path used for the run, once per run.
• --json output gains a group field per repo and a top-level config field — purely additive, no existing field renamed or removed.

Test plan

• gofmt -l ., go vet ./..., go test ./... -race -count=1 -v all pass
• New tests cover: group name propagation, a misconfigured signing_method producing a traceable error, the resolved config path appearing in both a successful and a failing report (for both sync and status), the FAIL line's path/group content, and the progress line's error text

Closes #63