fix(revlog): log fetch errors instead of aborting the process

[MsfPablo]

Summary

The unfiltered Log tab spawns a rayon worker that calls fetch_helper(...).expect(\"failed to fetch\") at asyncgit/src/revlog.rs. When the underlying gix discovery fails, the panic fires on a rayon worker thread and rayon re-aborts the whole process, killing gitui rather than just degrading the tab.

This is independent of #3015 (which fixes the git2 half of the same scenario). It addresses the escalation that #3017 explicitly calls out as worth handling regardless of the cwd question.

Fixes #3017.

Root cause

fetch() spawns a rayon worker:

rayon_core::spawn(move || {
    Self::fetch_helper(...).expect("failed to fetch");  // <- panics on Err
    ...
});

fetch_helper_without_filter calls gix_repo(repo_path), which uses gix::ThreadSafeRepository::discover_with_environment_overrides. gix discovery reads the process cwd unconditionally (gix/src/discover.rs::discover_opts sets options.current_dir from gix_fs::current_dir), so even passing an absolute repo root does not help when the process cwd has been deleted. The most reachable trigger is stashing untracked files from inside the now-removed subdirectory (libgit2 removes it; git stash -u refuses this but libgit2 has no such guard). The git2-based paths (repo() via git2::Repository::open_ext) do not consult the cwd for an absolute path, which is why get_stashes and the filtered log keep working while the unfiltered Log tab dies.

A panic on a rayon worker is not contained to the worker: rayon unwinds it and then re-aborts the process, so the user-visible symptom is gitui disappearing rather than an empty Log tab.

Fix

Replace the .expect(\"failed to fetch\") with the same error-logging idiom already used by asyncgit::status (asyncgit/src/status.rs), asyncgit::blame (asyncgit/src/blame.rs), and asyncgit::diff (asyncgit/src/diff.rs): log the fetch error and let the worker finish without aborting.

rayon_core::spawn(move || {
    scope_time!("async::revlog");

    if let Err(e) = Self::fetch_helper(...) {
        log::error!("fetch_helper revlog: {e}");
    }

    arc_pending.store(false, Ordering::Relaxed);
    Self::notify(&sender);
});

This does not change the cwd behaviour of gix discovery; it stops a discovery failure from escalating into a process abort. The Log tab simply shows no new commits for that fetch, which is the behaviour users already see for the git2 paths when the repo is temporarily unreadable.

Verification

• cargo build -p asyncgit — clean.
• cargo test -p asyncgit — 175 passed, 2 failed. The 2 failures (sync::sign::tests::test_openpgp_sign_and_verify_e2e, sync::sign::tests::test_x509_sign_and_verify_e2e) are pre-existing and reproduce on the unmodified base (they require gpg / gpgsm binaries that are not installed in this environment). Verified by stashing the change and re-running.
• cargo test -p asyncgit revlog — test_env_variables and test_smoke_in_subdir pass.
• cargo fmt --check -p asyncgit — clean.
• make clippy (cargo clippy --workspace --all-features, the command CI runs) — clean.

Note on regression testing

The panic path lives inside the rayon worker spawned by fetch(). A panic there is not contained to the worker thread: rayon unwinds it and re-aborts the whole process, which is exactly the bug. This also means a deterministic unit test cannot assert "the worker does not abort" — on the unmodified base the worker panic would abort the entire test binary (including other, unrelated tests), not just the test that triggered it. The lower-level fetch_helper_without_filter Err path is already covered by test_env_variables and test_smoke_in_subdir (they assert it returns Ok or Err without panicking). The change here mirrors the established status / blame / diff idiom, which is the project's existing answer to the same class of "rayon worker fetch failure" panics.

Reproduction of the original abort is documented in the issue body (a scratch crate linking asyncgit: create a repo, add an untracked subdirectory, set the process cwd inside it, stash_save(..., untracked=true), then call AsyncLog::fetch). After this change the same repro logs fetch_helper revlog: Gix(Discover(Discover(CurrentDir(...)))) and gitui stays alive instead of aborting.

AI disclosure

This change was prepared with agent assistance. The reproduction evidence is cited from the issue body; the fix mirrors the existing asyncgit::status / blame / diff error-handling idiom. The commands above were run locally to verify build, tests, fmt and clippy.