Close the set of failure kinds: refusal codes and internal failures

[ExtraToast]

Parent

#221

What to build

Every way the compiler can fail is an enumerable, named kind, so the full set can be read from the code rather than discovered by grepping.

Diagnostic.code becomes a closed type: the specification's E_ codes plus schema, kept in step with the specification by the codes gate, so an undefined code fails the typecheck. The compiler's own failures (the remaining throw new Error sites) become one named internal-failure type with a kind: a construct not rendered yet (a known gap), or a broken invariant (a bug). An authored mistake is never an internal failure: those become coded diagnostics under #204, which this ticket does not duplicate; classify only the throws that remain.

Acceptance criteria

• Constructing a diagnostic with a code the specification does not define fails the typecheck; a fixture proves it.
• The codes gate fails when the closed code type and the specification's codes drift apart.
• No bare throw new Error remains in the compiler; each is the internal-failure type with its kind, and a rule refuses a bare throw, with its ledger row and failing fixture.

Blocked by

None (can start immediately). Coordinate with #204, which turns some of the same throws into diagnostics.