Implement AST multi-error recovery

[LesterEvSe]

Analysis now reports every independent error in one pass instead of stopping at
the first.

• Poison, not fake values; Error variants in the parse tree, AST, and type
  system (TypeInner::Error); recovery emits these instead of fabricated units,
  aliases, or sizes.
• No cascades; poisoned types are absorbed during analysis (is_error guards
  and ResolvedType::compatible), so one broken construct does not spawn secondary
  errors.
• Collect, do not abort; Scope carries a diagnostics sink; containers record
  an error and keep analyzing siblings, and Program::analyze returns Option.
• Parser split; parse_from_str (fragments, first error) vs
  parse_from_content (files, collect all), over one shared core.

[apoelstra]

In 763b2d8:

I think we should call the Error type "Uninhabited" (or "Never" if we want to be Rust-like), and similarly the is_error method should be is_uninhabited (or is_never or is_empty ... though I think is_empty would be confusing because it's such a common name in Rust).

The empty type has the properties you want -- it cannot be constructed, no code should ever be compiled which accepts it, and there is a unique function mapping it to every other type, and I'd like to add it to the language anyway, so we might as well add it here.

In 8a1b03c:

Adds a blank line to witness.rs, otherwise doesn't touch the file.