[F053] _token_for_project: log decryption failure (key rotation) with project slug

roboco/services/git.py

@@ -309,13 +309,29 @@ class GitService(BaseService):
         return result
 
     async def _token_for_project(self, project_slug: str) -> str | None:
-        """Decrypted project token for orchestrator-side remote git ops."""
+        """Decrypted project token for orchestrator-side remote git ops.
+
+        A decryption failure (an encryption-key rotation left the stored PAT
+        encrypted with the old key) is logged loudly with the project slug
+        before returning None — without this every best-effort workspace git
+        op (push, PR, clone-with-token) silently looks like 'this project has
+        no token', indistinguishable from a project that genuinely never set
+        one, and the operator can't tell which project a key rotation wedged.
+        The best-effort skip behavior is preserved (callers still get None and
+        skip the remote op); this only makes the cause diagnosable.
+        """
         from roboco.utils.crypto import EncryptionError
 
         project_service = get_project_service(self.session)
         try:
             return await project_service.get_decrypted_token_by_slug(project_slug)
-        except EncryptionError:
+        except EncryptionError as exc:
+            self.log.error(
+                "git token decryption failed — encryption key may have rotated;"
+                " treating as no-token for this project's remote git ops",
+                project_slug=project_slug,
+                error=str(exc),
+            )
             return None
 
     async def _token_for_workspace(self, workspace: Path) -> str | None: