fix(proxy): include partial identity fields in fallback warning

Include binary, binary_pid, and ancestors from IdentityError in the
warn!() structured fields so they provide diagnostics in production.
Fixes clippy dead_code lint on IdentityError fields.

Signed-off-by: Paolo Dettori <paolo@dettori.dev>
Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Paolo Dettori <dettori@us.ibm.com>

Author: pdettori

crates/openshell-sandbox/src/proxy.rs

@@ -1405,8 +1405,12 @@ fn evaluate_opa_tcp(
             // Fall through to OPA with an unresolved identity — policies without
             // binary restrictions (empty binaries list) will still allow.
             warn!(
-                "identity resolution failed (port={peer_port}): {}; using unresolved identity",
-                err.reason
+                port = peer_port,
+                reason = %err.reason,
+                binary = ?err.binary,
+                binary_pid = ?err.binary_pid,
+                ancestors = ?err.ancestors,
+                "identity resolution failed; using unresolved identity",
             );
             ResolvedIdentity {
                 bin_path: PathBuf::from("<unresolved>"),