check: make `registry_unreachable` per-ecosystem rather than per-manifest

[justin13888]

What happens now

ManifestCheck::registry_unreachable is one boolean per manifest, set when any registry
lookup for that manifest failed for a reason other than the package not existing. The
CLI's --fail-on gate refuses to certify a run when any manifest carries it.

Why that is coarse

A polyglot monorepo checks many manifests across many ecosystems in one run. If
proxy.golang.org times out, the whole run is unanswerable — including the npm, Python
and Rust manifests whose registries answered every request perfectly. The gate is right
that something was not established, but it cannot say what, and the user cannot act on
"the registry did not answer" without finding out which one.

Per-manifest is also not quite the natural unit: a single manifest can route to more than
one registry (a Cargo.toml naming an alternate registry alongside crates.io, a
deno.json importing both jsr: and npm: specifiers), and those are tracked with
separate cache keys already.

Proposal

Carry the unreachable set per registry (or per ecosystem), so:

• the gate's message names which registry did not answer;
• a future opt-in could let a run be certified over the ecosystems that did answer,
  rather than all-or-nothing.

ErrorOrigin::Unanswered on each CheckResult (added in #99) already carries the
per-dependency half of this; what is missing is the routing key alongside it.

Context

Raised during the second review round of #99. The decision there was that the single
boolean stays for that PR — the granularity is a real improvement, not a defect repair.