fix: keep the wrapped cause in NotFound and PermissionDenied messages

[basgys]

A production outage in lakehouse-games took far longer to diagnose than it should have, because the only thing the logs said was pipeline: resource not found. The cause was a connector instance missing from the deployed config, and the error that knew its name — connector "wikipedia" not registered — was wrapped in a MissingFailure and thrown away.

Why the cause disappeared

MissingFailure.Error and PermissionFailure.Error returned a bare constant and ignored the error they wrap, so WithNotFound(err) rendered as resource not found regardless of what err said. Every other failure type in the package already routes through maybeWrap and appends the cause, which is what makes WithBad read as bad request: underlying issue. These two were the exceptions, and they are the two that most often carry the only useful detail — which resource, whose permission.

Both now use maybeWrap. The NotFound and PermissionDenied singletons wrap a nil error, and maybeWrap returns the bare message in that case, so their output does not change and neither does anything matching on it.

The cause was always reachable through Unwrap, so this changes only what callers see when they print or log the error — which is where it mattered. pkg/httpfaults in lakehouse-games maps these to status codes by type, not by message, so response codes are unaffected; a handler that echoes err.Error() into a response body will now include the wrapped cause, which is worth a look if any of them do that on a not-found path.

---

Note

Low Risk
Localized error-string formatting in the faults package; type-based status mapping is unaffected, though any code that echoes err.Error() on not-found paths may now expose more detail in responses.

Overview
NotFound and PermissionDenied errors now surface wrapped causes in Error() strings, matching how other fault types use maybeWrap.

MissingFailure.Error and PermissionFailure.Error previously returned fixed "resource not found" and "permission denied" and dropped any parent passed through WithNotFound / WithPermissionDenied, so logs often showed only the generic label. Both methods now call maybeWrap, so wrapped errors read like resource not found: underlying issue. Singletons with no wrapped error still return the same bare messages.

Tests in faults_test.go assert the new message format for WithNotFound and WithPermissionDenied when a cause is present. Unwrap and errors.Is behavior are unchanged; only printed/logged text changes for wrapped errors.

^{Reviewed by Cursor Bugbot for commit 4f6549f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_9644d9e0-8de0-4f34-bfe5-6ecd74f34e8c)