refactor: canonical failable syntax (T, !) — remove the bare -> T ! sugar

The trailing-`!`-after-the-value-type spelling (`-> T !`, `-> Tuple(A,B) !`) was a
redundant second way to write a failable return that the parser folded into the
same AST as the parenthesized `(T, !)` / `(A, B, !)` result list. Remove it so
there is ONE canonical spelling: the error channel always rides as the last slot
of the parenthesized list.

- parser: `parseFnReturnType` no longer folds a trailing `!` after a value type —
  it rejects it with a located diagnostic ("a failable return is written `(T, !)`
  … not `T !`"). This one chokepoint covers fn declarations, lambdas, fn-pointer
  types `(A) -> R`, and closure types `Closure(A) -> R`. The error-ONLY `-> !` /
  `-> !ErrSet` form is unaffected (parsed by parseTypeExpr as an error_type_expr).
- migrated every usage to canonical form across library/ + examples/ + issues/ +
  tests/: `-> T !E` → `-> (T, !E)`; the value-carrying `-> Tuple(A, B) !` (which
  FLATTENED to a multi-value failable) → `-> (A, B, !)`, preserving behavior. A
  genuine single-tuple-value failable stays `-> (Tuple(A,B), !)`.
- parser unit tests: the "bare form folds" tests become "bare form is rejected";
  canonical-form parse tests retained.
- docs: specs.md §12 + scattered refs and readme.md updated to the `(T, !)` form.

Behavior-preserving (the bare form was sugar for the same AST). Adversarial review
confirmed: rejection complete across all positions, every canonical form works on
both success/error paths, error-only `-> !` intact, no crashes. Full suite green
(unit tests + 850 corpus examples).

library/modules/std/socket.sx

@@ -93,7 +93,7 @@ SockErr :: error {
 // Accept one pending connection on a nonblocking listener. A connection
 // that died between queueing and accept (ECONNABORTED) is skipped, not
 // surfaced — the listener is fine.
-accept_nb :: (fd: i32) -> i32 !SockErr {
+accept_nb :: (fd: i32) -> (i32, !SockErr) {
     while true {
         c := accept(fd, null, null);
         if c >= 0 { return c; }
@@ -107,7 +107,7 @@ accept_nb :: (fd: i32) -> i32 !SockErr {
 
 // Read up to `cap` bytes. Returns the byte count (> 0); an orderly EOF
 // or a peer reset is Closed.
-read_nb :: (fd: i32, buf: [*]u8, cap: usize) -> i64 !SockErr {
+read_nb :: (fd: i32, buf: [*]u8, cap: usize) -> (i64, !SockErr) {
     while true {
         n := read(fd, buf, cap);
         if n > 0 { return xx n; }
@@ -123,7 +123,7 @@ read_nb :: (fd: i32, buf: [*]u8, cap: usize) -> i64 !SockErr {
 
 // Write up to `len` bytes, returning how many the kernel took (possibly
 // fewer — the caller continues from there on the next writability).
-write_nb :: (fd: i32, buf: [*]u8, len: usize) -> i64 !SockErr {
+write_nb :: (fd: i32, buf: [*]u8, len: usize) -> (i64, !SockErr) {
     while true {
         n := write(fd, buf, len);
         if n >= 0 { return xx n; }