refactor: canonical failable syntax (T, !) — remove the bare -> T ! sugar

The trailing-`!`-after-the-value-type spelling (`-> T !`, `-> Tuple(A,B) !`) was a
redundant second way to write a failable return that the parser folded into the
same AST as the parenthesized `(T, !)` / `(A, B, !)` result list. Remove it so
there is ONE canonical spelling: the error channel always rides as the last slot
of the parenthesized list.

- parser: `parseFnReturnType` no longer folds a trailing `!` after a value type —
  it rejects it with a located diagnostic ("a failable return is written `(T, !)`
  … not `T !`"). This one chokepoint covers fn declarations, lambdas, fn-pointer
  types `(A) -> R`, and closure types `Closure(A) -> R`. The error-ONLY `-> !` /
  `-> !ErrSet` form is unaffected (parsed by parseTypeExpr as an error_type_expr).
- migrated every usage to canonical form across library/ + examples/ + issues/ +
  tests/: `-> T !E` → `-> (T, !E)`; the value-carrying `-> Tuple(A, B) !` (which
  FLATTENED to a multi-value failable) → `-> (A, B, !)`, preserving behavior. A
  genuine single-tuple-value failable stays `-> (Tuple(A,B), !)`.
- parser unit tests: the "bare form folds" tests become "bare form is rejected";
  canonical-form parse tests retained.
- docs: specs.md §12 + scattered refs and readme.md updated to the `(T, !)` form.

Behavior-preserving (the bare form was sugar for the same AST). Adversarial review
confirmed: rejection complete across all positions, every canonical form works on
both success/error paths, error-only `-> !` intact, no crashes. Full suite green
(unit tests + 850 corpus examples).

examples/errors/1044-errors-generic-failable-composition.sx

@@ -9,21 +9,21 @@
 
 E :: error { Bad }
 
-wrap :: ($T: Type, f: Closure() -> T !E) -> T !E { return try f(); }
+wrap :: ($T: Type, f: Closure() -> (T, !E)) -> (T, !E) { return try f(); }
 
 main :: () -> i32 {
     // success, consumed by catch
-    print("catch={}\n", wrap(i32, closure(() -> i32 !E { return 7; })) catch (e) -1);   // 7
+    print("catch={}\n", wrap(i32, closure(() -> (i32, !E) { return 7; })) catch (e) -1);   // 7
 
     // success, consumed by destructure (binds value + error slot); the value
     // slot is read only under an `if !err` guard (ERR E1.8 path-sensitivity)
-    r, err := wrap(i32, closure(() -> i32 !E { return 9; }));
+    r, err := wrap(i32, closure(() -> (i32, !E) { return 9; }));
     if !err { print("destr={} ok=true\n", r); }                                           // destr=9 ok=true
 
     // failure path: the raised tag propagates through the generic `try`
-    print("fail={}\n", wrap(i32, closure(() -> i32 !E { raise error.Bad; }) ) catch (e) -1); // -1
+    print("fail={}\n", wrap(i32, closure(() -> (i32, !E) { raise error.Bad; }) ) catch (e) -1); // -1
 
     // a second monomorphization at a different T
-    print("u8={}\n", wrap(u8, closure(() -> u8 !E { return 200; })) catch (e) 0);         // 200
+    print("u8={}\n", wrap(u8, closure(() -> (u8, !E) { return 200; })) catch (e) 0);         // 200
     return 0;
 }