Implement AST multi-error recovery

[LesterEvSe]

Analysis now reports every independent error in one pass instead of stopping at
the first.

• Poison, not fake values; Error variants in the parse tree, AST, and type
  system (TypeInner::Error); recovery emits these instead of fabricated units,
  aliases, or sizes.
• No cascades; poisoned types are absorbed during analysis (is_error guards
  and ResolvedType::compatible), so one broken construct does not spawn secondary
  errors.
• Collect, do not abort; Scope carries a diagnostics sink; containers record
  an error and keep analyzing siblings, and Program::analyze returns Option.
• Parser split; parse_from_str (fragments, first error) vs
  parse_from_content (files, collect all), over one shared core.

[apoelstra]

In 763b2d8:

I think we should call the Error type "Uninhabited" (or "Never" if we want to be Rust-like), and similarly the is_error method should be is_uninhabited (or is_never or is_empty ... though I think is_empty would be confusing because it's such a common name in Rust).

The empty type has the properties you want -- it cannot be constructed, no code should ever be compiled which accepts it, and there is a unique function mapping it to every other type, and I'd like to add it to the language anyway, so we might as well add it here.

In 8a1b03c:

Adds a blank line to witness.rs, otherwise doesn't touch the file.

[LesterEvSe]

In 763b2d8:

I think we should call the Error type "Uninhabited" (or "Never" if we want to be Rust-like), and similarly the is_error method should be is_uninhabited (or is_never or is_empty ... though I think is_empty would be confusing because it's such a common name in Rust).

Changed Error to Never and is_error to is_never in types.rs

In 8a1b03c:

Adds a blank line to witness.rs, otherwise doesn't touch the file.

I accidentally refactored the code while reviewing it. Deleted it.

[apoelstra]

In fdfae8b:

What is a "recovered subtree" what does it mean to "re-report" a type?

[apoelstra]

In fdfae8b:

This one is not unreachable. We should return an Arbitrary error here indicating that there is no value of the never type.

[LesterEvSe]

Agreed with @KyrylR that this PR is too large to review as one unit. I'm splitting it into a sequence:

(Rough split, not yet validated)

1. Add the uninhabited Never type to TypeInner (+ is_never,
   ResolvedType::compatible, and the Arbitrary impl returning an error
   instead of unreachable!). Standalone and useful on its own.
2. Error variants in the parse tree + parser recovery (Implement error states in parser #205).
3. Diagnostics sink in Scope; containers collect instead of aborting (Error recovery in analysis #207).
4. Split parse_from_str / parse_from_content by error policy.

@apoelstra, I plan to address your comment about the Arbitrary branch in (1). I'll also rewrite the doc comment "recovered subtree" and "re-report" are not defined anywhere. Sorry for the churn.

Keeping this open as a draft for the overall design; I'll close it once (4)
is merged.