Implement AST multi-error recovery

[LesterEvSe]

Analysis now reports every independent error in one pass instead of stopping at
the first.

• Poison, not fake values; Error variants in the parse tree, AST, and type
  system (TypeInner::Error); recovery emits these instead of fabricated units,
  aliases, or sizes.
• No cascades; poisoned types are absorbed during analysis (is_error guards
  and ResolvedType::compatible), so one broken construct does not spawn secondary
  errors.
• Collect, do not abort; Scope carries a diagnostics sink; containers record
  an error and keep analyzing siblings, and Program::analyze returns Option.
• Parser split; parse_from_str (fragments, first error) vs
  parse_from_content (files, collect all), over one shared core.

[apoelstra]

In 763b2d8:

I think we should call the Error type "Uninhabited" (or "Never" if we want to be Rust-like), and similarly the is_error method should be is_uninhabited (or is_never or is_empty ... though I think is_empty would be confusing because it's such a common name in Rust).

The empty type has the properties you want -- it cannot be constructed, no code should ever be compiled which accepts it, and there is a unique function mapping it to every other type, and I'd like to add it to the language anyway, so we might as well add it here.

In 8a1b03c:

Adds a blank line to witness.rs, otherwise doesn't touch the file.

[LesterEvSe]

In 763b2d8:

I think we should call the Error type "Uninhabited" (or "Never" if we want to be Rust-like), and similarly the is_error method should be is_uninhabited (or is_never or is_empty ... though I think is_empty would be confusing because it's such a common name in Rust).

Changed Error to Never and is_error to is_never in types.rs

In 8a1b03c:

Adds a blank line to witness.rs, otherwise doesn't touch the file.

I accidentally refactored the code while reviewing it. Deleted it.

[apoelstra]

In fdfae8b:

What is a "recovered subtree" what does it mean to "re-report" a type?

[apoelstra]

In fdfae8b:

This one is not unreachable. We should return an Arbitrary error here indicating that there is no value of the never type.