Use fail points to test I/O failures

Just saw the new release of the [fail](https://docs.rs/fail/0.3.0/fail/) crate, which allows easily injecting error scenarios. This lets us write tests that assert we handle these errors in a graceful way, with helpful output.

- [ ] Add fail as an optional dependency
- [ ] Add a fail point and test triggering something like "crates.io couldn't be resolved"
- [ ] Add a fail point and test triggering something like "response from crates.io timed out"

The issue names no files or existing tests. Start by reviewing the dependency configuration and the code paths that contact crates.io, then use the fail crate to exercise resolution and timeout failures. Done means optional fail-point support and tests that verify graceful, helpful output for both scenarios.

Written by the indexing model from the issue text.