Instrument elevation path to diagnose ineffective grants

A SharePoint admin reported the grant runs without a logged error yet the
account never appears as site-collection admin on Group/Teams sites. The
failure was invisible: ElevateAsync called ExecuteQueryAsync directly (no
enrichment/logging) and the coordinator only surfaced elevate failures on the
page, not to Serilog.

- Route the admin-endpoint ExecuteQuery through ExecuteQueryRetryHelper so a
  denial there is enriched (serverErrorType/httpStatus) and logged.
- Log the resolved login and SetSiteAdmin acceptance in OwnershipElevationService.
- Log elevate failures to Serilog in the coordinator.
- Add a post-elevation verify that reads CurrentUser.IsSiteAdmin on the target
  site so logs distinguish a failed/no-op grant from a scan failing for another
  reason. Diagnostic only; never throws into the operation flow.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Services/OwnershipElevationService.cs

@@ -1,5 +1,7 @@
 using Microsoft.Online.SharePoint.TenantAdministration;
 using Microsoft.SharePoint.Client;
+using Serilog;
+using SharepointToolbox.Web.Core.Helpers;
 using SharepointToolbox.Web.Services.Audit;
 
 namespace SharepointToolbox.Web.Services;
@@ -15,12 +17,20 @@ public class OwnershipElevationService : IOwnershipElevationService
         if (string.IsNullOrWhiteSpace(loginName))
         {
             tenantAdminCtx.Load(tenantAdminCtx.Web.CurrentUser, u => u.LoginName);
-            await tenantAdminCtx.ExecuteQueryAsync();
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(tenantAdminCtx, null, ct);
             loginName = tenantAdminCtx.Web.CurrentUser.LoginName;
         }
+
+        Log.Information("SetSiteAdmin: granting {Login} site-collection admin on {Site} via admin endpoint {Admin}",
+            loginName, siteUrl, tenantAdminCtx.Url);
+
         var tenant = new Tenant(tenantAdminCtx);
         tenant.SetSiteAdmin(siteUrl, loginName, isSiteAdmin: true);
-        await tenantAdminCtx.ExecuteQueryAsync();
+        // Route through the enricher so a denial on the admin endpoint surfaces the real reason
+        // (and gets logged) instead of a bare 403 the caller has to guess at.
+        await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(tenantAdminCtx, null, ct);
+
+        Log.Information("SetSiteAdmin call accepted for {Site} (login {Login})", siteUrl, loginName);
         await _audit.LogAsync("ElevateOwnership", tenantAdminCtx.Url, new[] { siteUrl },
             $"Site admin granted to {loginName}");
     }