refactor: canonical failable syntax (T, !) — remove the bare -> T ! sugar

The trailing-`!`-after-the-value-type spelling (`-> T !`, `-> Tuple(A,B) !`) was a
redundant second way to write a failable return that the parser folded into the
same AST as the parenthesized `(T, !)` / `(A, B, !)` result list. Remove it so
there is ONE canonical spelling: the error channel always rides as the last slot
of the parenthesized list.

- parser: `parseFnReturnType` no longer folds a trailing `!` after a value type —
  it rejects it with a located diagnostic ("a failable return is written `(T, !)`
  … not `T !`"). This one chokepoint covers fn declarations, lambdas, fn-pointer
  types `(A) -> R`, and closure types `Closure(A) -> R`. The error-ONLY `-> !` /
  `-> !ErrSet` form is unaffected (parsed by parseTypeExpr as an error_type_expr).
- migrated every usage to canonical form across library/ + examples/ + issues/ +
  tests/: `-> T !E` → `-> (T, !E)`; the value-carrying `-> Tuple(A, B) !` (which
  FLATTENED to a multi-value failable) → `-> (A, B, !)`, preserving behavior. A
  genuine single-tuple-value failable stays `-> (Tuple(A,B), !)`.
- parser unit tests: the "bare form folds" tests become "bare form is rejected";
  canonical-form parse tests retained.
- docs: specs.md §12 + scattered refs and readme.md updated to the `(T, !)` form.

Behavior-preserving (the bare form was sugar for the same AST). Adversarial review
confirmed: rejection complete across all positions, every canonical form works on
both success/error paths, error-only `-> !` intact, no crashes. Full suite green
(unit tests + 850 corpus examples).

examples/errors/1036-errors-failable-smoke.sx

@@ -9,7 +9,7 @@
 SmokeErr :: error { Empty, BadDigit, Overflow }
 
 // value-carrying, named set
-sm_parse :: (n: i32) -> i32 !SmokeErr {
+sm_parse :: (n: i32) -> (i32, !SmokeErr) {
     if n < 0  { raise error.BadDigit; }
     if n == 0 { raise error.Empty; }
     if n > 99 { raise error.Overflow; }
@@ -23,7 +23,7 @@ sm_check :: (ok: bool) -> ! {
 }
 
 // multi-value, inferred set: `try` propagates; SCC absorbs SmokeErr
-sm_pair :: (a: i32, b: i32) -> Tuple(i32, i32) ! {
+sm_pair :: (a: i32, b: i32) -> (i32, i32, !) {
     x := try sm_parse(a);
     y := try sm_parse(b);
     return .(x, y);
@@ -38,7 +38,7 @@ sm_or_default :: (n: i32) -> i32 {
 }
 
 // onfail + defer interleave: cleanup runs only on the error path
-sm_acquire :: (fail: bool) -> i32 ! {
+sm_acquire :: (fail: bool) -> (i32, !) {
     defer  print("  defer A\n");
     onfail print("  onfail B\n");
     if fail { raise error.Acquire; }
@@ -46,7 +46,7 @@ sm_acquire :: (fail: bool) -> i32 ! {
 }
 
 // or-chain: try a, fall to try b; propagate if both fail
-sm_first :: (a: i32, b: i32) -> i32 ! {
+sm_first :: (a: i32, b: i32) -> (i32, !) {
     v := try sm_parse(a) or try sm_parse(b);
     return v;
 }
@@ -54,18 +54,18 @@ sm_first :: (a: i32, b: i32) -> i32 ! {
 // --- Composition (ERR E5.1): failable closures, widening, generics ---
 
 // Closure(...) param, try-propagated (the env is carried)
-sm_run :: (cb: Closure(i32) -> i32 !SmokeErr, n: i32) -> i32 !SmokeErr {
+sm_run :: (cb: Closure(i32) -> (i32, !SmokeErr), n: i32) -> (i32, !SmokeErr) {
     return try cb(n);
 }
 
 // bare fn-type param: a NON-failable closure literal widens into the failable
 // slot (the ∅-widening adapter wraps `{value, 0}`)
-sm_widen :: (cb: (i32) -> i32 !SmokeErr, n: i32) -> i32 {
+sm_widen :: (cb: (i32) -> (i32, !SmokeErr), n: i32) -> i32 {
     return cb(n) catch (e) -1;
 }
 
 // generic ($T) value-carrying failable composition, monomorphized per call
-sm_wrap :: ($T: Type, f: Closure() -> T !SmokeErr) -> T !SmokeErr {
+sm_wrap :: ($T: Type, f: Closure() -> (T, !SmokeErr)) -> (T, !SmokeErr) {
     return try f();
 }
 
@@ -120,15 +120,15 @@ main :: () {
     iv, ierr := sm_acquire(false);
 
     // composition: inline failable closure literal through a Closure(...) param
-    cl := sm_run(closure((x: i32) -> i32 !SmokeErr { if x < 0 { raise error.BadDigit; } return x * 2; }), 6) catch (e) -1;
+    cl := sm_run(closure((x: i32) -> (i32, !SmokeErr) { if x < 0 { raise error.BadDigit; } return x * 2; }), 6) catch (e) -1;
     print("closure-run: {}\n", cl);                                                     // 12
-    print("closure-run-err: {}\n", sm_run(closure((x: i32) -> i32 !SmokeErr { raise error.Empty; }), 1) catch (e) -9); // -9
+    print("closure-run-err: {}\n", sm_run(closure((x: i32) -> (i32, !SmokeErr) { raise error.Empty; }), 1) catch (e) -9); // -9
 
     // non-failable closure literal widened into the failable bare slot
     print("widen: {}\n", sm_widen(closure((x: i32) -> i32 => x + 1), 9));               // 10
 
     // generic failable composition (monomorphized at i32)
-    print("wrap: {}\n", sm_wrap(i32, closure(() -> i32 !SmokeErr { return 42; })) catch (e) 0); // 42
+    print("wrap: {}\n", sm_wrap(i32, closure(() -> (i32, !SmokeErr) { return 42; })) catch (e) 0); // 42
 
     print("errors ok\n");
 }