Make sure that hg errors are properly added to the plan log

Currently we just throw RepositoryExceptions.
Some errors - esp 'authentication failure' - should be explicitly added to the log so the user sees it.

Blocker - if it happens in change detection phase, the log is not visible at the moment - difficult to test.