Add naughty list for git remotes with persistent SSL/DNS errors

Implement domain-level naughty list tracking for git remotes, reusing the
existing NaughtyListTracker from relay sync. This prevents repeated attempts
to fetch from git domains with persistent infrastructure issues (SSL/TLS
certificate errors, DNS failures).

Changes:
- Updated NaughtyListTracker to track both relay URLs and git domains
- Added git_naughty_list field to RealSyncContext for error classification
- Modified fetch_oids() to classify git fetch errors and record naughty domains
- Updated sync_identifier_next_url() to filter out naughty domains during URL selection
- Added git_naughty_list parameter to ThrottleManager for domain queue processing
- Threaded naughty list through start_sync_loop and all sync functions
- Updated all tests to pass naughty list parameter

The naughty list uses 12-hour expiration (configurable) to allow domains to
recover from infrastructure issues. First occurrence logs WARN, repeats log DEBUG.

1 files changed, 32 insertions, 3 deletions

diff --git a/src/purgatory/sync/throttle.rs b/src/purgatory/sync/throttle.rs
index ad6e8ea..7f8f636 100644
--- a/src/purgatory/sync/throttle.rs
+++ b/src/purgatory/sync/throttle.rs
@@ -24,6 +24,7 @@ use tracing::debug;
 
 use super::context::SyncContext;
 use super::functions::{sync_identifier_from_url, sync_identifier_next_url};
+use crate::sync::naughty_list::NaughtyListTracker;
 
 /// State for an identifier waiting in a domain's queue.
 ///
@@ -265,6 +266,10 @@ pub struct ThrottleManager {
     /// Sync context for processing queued identifiers.
     /// Set once at startup via `set_context()`.
     ctx: OnceLock<Arc<dyn SyncContext>>,
+
+    /// Naughty list tracker for git remote domains with persistent errors.
+    /// Set once at startup via `set_git_naughty_list()`.
+    git_naughty_list: OnceLock<Arc<NaughtyListTracker>>,
 }
 
 impl ThrottleManager {
@@ -279,6 +284,7 @@ impl ThrottleManager {
             max_concurrent_per_domain: max_concurrent,
             max_per_minute_per_domain: max_per_minute,
             ctx: OnceLock::new(),
+            git_naughty_list: OnceLock::new(),
         }
     }
 
@@ -294,6 +300,17 @@ impl ThrottleManager {
         let _ = self.ctx.set(ctx);
     }
 
+    /// Set the git naughty list tracker (called once at startup).
+    ///
+    /// The naughty list is used to filter out domains with persistent errors
+    /// during URL selection.
+    ///
+    /// # Arguments
+    /// * `git_naughty_list` - The naughty list tracker
+    pub fn set_git_naughty_list(&self, git_naughty_list: Arc<NaughtyListTracker>) {
+        let _ = self.git_naughty_list.set(git_naughty_list);
+    }
+
     /// Check if a domain is currently throttled (at capacity).
     ///
     /// Returns true if the domain has no capacity for another request,
@@ -479,10 +496,22 @@ impl ThrottleManager {
                 .unwrap_or_default()
         };
 
+        // Get naughty list (should be set at startup)
+        let naughty_list = self
+            .git_naughty_list
+            .get()
+            .expect("git_naughty_list not set");
+
         // Get next URL for this identifier on this specific domain
-        let url =
-            sync_identifier_next_url(ctx.as_ref(), identifier, Some(domain), &tried_urls, self)
-                .await;
+        let url = sync_identifier_next_url(
+            ctx.as_ref(),
+            identifier,
+            Some(domain),
+            &tried_urls,
+            self,
+            naughty_list.as_ref(),
+        )
+        .await;
 
         match url {
             Some(url) => {