diag-1: type-error recovery, multiple diagnostics, caret rendering

[vpisarev]

Groundwork for an LSP: one compiler run now reports many useful type errors
instead of dying on the first, with cascade noise suppressed, gcc/clang-style
caret excerpts, and "did you mean" suggestions.

file.fx:2:9: error: the appropriate match for 'lenght' of type '<unknown>' is not found; did you mean 'length'?
 2 | val x = lenght + 1
   |         ^

What you get

• N independent errors → N diagnostics in one run (was: die on the first).
• A cascade → exactly one diagnostic: val x = undef; x+1; f(x) reports only
  the root undef.
• Broken body behind a declared signature → callers stay clean; only a
  genuinely mistyped caller errors (the "annotations are firewalls" dividend).
• Errors in several match arms / if branches are all reported in one run.
• "did you mean 'length'?" on typo'd identifiers, constructors and fields.
• gcc/clang caret excerpts on frontend diagnostics; sorted by source
  position; exact duplicates deduped; capped by -fmax-errors=N (default 100).

How it works (recovery lives strictly above unification)

Recovery = report + poison with TypErr + continue. It rides the machinery
that already existed (a per-item try/catch in check_eseq, one compile_err
→ CompileError → push_compile_err accumulation path) — adapted, not rebuilt.
The key insight: TypErr (the ctrlflow-1 poison type) already flows silently
through unify without binding, so poisoning a failed symbol with TypErr
gives structural cascade suppression almost for free.

• typ_has_typerr + three choke points (lookup_id, scan_'s IdDVal,
  commit_fun) suppress a resolution whose operand/callee is already poisoned
  and propagate the TypErr to the result. They only fire on already-failed
  paths, so a clean compile is unaffected — the -pr-resolve census is
  byte-identical (the 7 under-constrained fallbacks unchanged).
• DefVal: the annotation unify moved inside the recovery try; every name
  the pattern binds (tuple/record/as, via walk_pat) is poisoned — with the
  declared type when annotated (firewall), TypErr otherwise.
• DefFun: a body failure keeps the declared signature; the return type is
  recovered from the branches that DID typecheck (an early return 42 pins
  it), poisoned to TypErr only if nothing did.
• check_cases / ExpIf: per-arm / per-branch recovery — a poisoned arm/branch
  contributes no type, so the healthy siblings determine the result (the
  jumping-throw/ctrlflow-1 logic).
• Templates: body errors surface at instantiation and poison correctly;
  duplicates across N instantiations collapse in the dedup.

Stage-honest caret precision

loc_excerpt draws the excerpt at raise time (inside compile_err /
compile_warning), because precision depends on the compilation stage, which
advances as the driver runs. Precision is governed by an explicit
Ast.compiler_stage (Init|Frontend|Middle|Backend), deliberately separate
from the implicit freeze_ids:

• Frontend = lexer + parser + typecheck and K-normalization — all
  consume the AST with exact locations, so even a non-exhaustive-match error
  (raised in K-normalization) gets a caret.
• Middle (K optimizations: inlining/fusion) and Backend (C generation)
  drop the caret: locations drift there and not all context reaches C-gen
  intact, so a confident caret would point at an innocent line.

One renderer serves errors and warnings. Legality checks were pulled the right
way across this line too: break/continue inside a @parallel loop is now a
typecheck diagnostic (exact caret, visible under -no-c, golden-able)
instead of a late C-gen error.

Test-format change (reviewers: read the golden diff as a format change)

Every test/negative/*.err golden now carries the source line + caret. The T3
harness (tools/fxtest/negative.py) was made caret-aware: excerpt lines
( N | src / | ^) are compared verbatim (their spacing is the contract);
all other lines keep the whitespace-collapse. New directed goldens:
multi-error, cascade, firewall, match-arm recovery, -fmax-errors truncation,
did-you-mean, and the lifted @parallel check.

Verification

• test_all 147; fxtest all (unit + negative 85 + ir + cfold + corpus O0/O3);
  determinism 3/3; sanitize clean.
• -pr-resolve census: byte-identical resolution — the extra sites are new
  diagnostic code only (recovery choke points fire solely on poisoned types).
• Bootstrap fixpoint holds. The scope_t/ScLoop layout change (for the
  @parallel lift) reorders many bootstrap modules — a compile-time-only type
  (like options_t); generated C for user programs is unchanged.

Not in scope (follow-ups, noted in docs/diag1_report.md)

• ^~~~ column spans (most locs are single-point today).
• Actually SUPPORTING break/continue in @parallel loops (currently
  rejected); when that lands, relax the lifted check rather than reject.

Full write-up: docs/diag1_report.md.