Improve sync summary logging: severity breakdowns, fixed link-failure visibility

### Problem
The current dry-run/live sync summary log has several gaps that make it hard to act on:
- Lifecycle counters (created/reopened/closed/title updated/body updated) have no severity breakdown, so a line like "created: 15" gives no sense of urgency (15 criticals vs. 15 lows look the same).
- Some log lines use a non-actionable `alert N` identifier instead of something traceable back to the finding (e.g. fingerprint or rule ID).
- When linking a new child issue to its parent (or repairing a missing link) fails via the GitHub API, the failure is currently silent — nothing is logged, so broken parent/child links go unnoticed.

### Desired behavior
- Every lifecycle counter in the sync summary (parents/children: created, reopened, closed, title updated, body updated) should show a per-severity breakdown, not just a total.
- Log messages should identify findings by fingerprint/rule ID instead of a bare alert number.
- Both the initial link and the relink/repair path must log a warning when the GitHub API call fails, and only log success after a confirmed successful call. Both paths should follow the same log message format so they're easy to correlate.
- The label auto-create step should log when it successfully ensures the label exists in the target repo.
- The label-migration sweep should report what it did (issues migrated, labels added/removed) as part of the sync summary, with an explicit "no action needed" line when there's nothing to migrate.
- The remaining hardcoded `"DRY-RUN: "` debug strings should be replaced with the shared prefix constant for consistency.
- Ideally, the summary-rendering logic should be extracted into its own reusable function/module so it isn't duplicated if a future notification channel (e.g. Teams) needs the same summary content.

### Acceptance criteria
- [ ] `SyncStats` (or equivalent) tracks per-severity counts for every lifecycle event listed above.
- [ ] Sync summary log output includes severity breakdowns per event, and collapses to "no changes" cleanly when nothing happened.
- [ ] Link and relink both log a warning on API failure and a success message only after a confirmed success, using a consistent, alert-traceable format.
- [ ] Label auto-create success and label-migration sweep outcomes (including the zero-action case) are visible in the logs/summary.
- [ ] No hardcoded `"DRY-RUN: "` strings remain; the shared prefix constant is used everywhere.
- [ ] Unit tests cover the new severity-breakdown logic, link/relink failure paths, and label-action logging.