managed_refresh_failure() -> ProviderStatus | NoneReturn the status of the last refresh that produced no policy.
A failed refresh does not change what the process enforces: the last enforceable generation keeps resolving, which is what fail-closed requires. That makes the failure invisible to every surface that reads the served snapshot, so it is reported from here instead.