Make logger failures unable to change cache behavior

[lan17]

Priority

P0 — Critical — resolve before the next release presented as production-ready.

Problem

Metrics callbacks are isolated, but logger methods are called directly inside fail-open and error-preservation paths. A throwing injected logger can turn a cache failure into an application failure, prevent fallback execution, or replace the original invalidation error.

Evidence:

• Direct logger calls in key/config and invalidation paths
• Direct logger calls around Redis/local failures
• Additional direct logging
• Metrics are already wrapped safely

Acceptance criteria

• Route all logging through a non-throwing facade.
• A throwing logger must never change a successful fallback result.
• A throwing logger must never mask the original explicit invalidation/maintenance error.
• Cover key construction, config provider, local read/write, Redis read/write, and invalidation failures.
• Avoid recursive logging when the logger itself fails.