Preserve and classify native Windows filesystem errors

[LunaStev]

The portable filesystem entry point promises negative errno-style failures, but the Windows implementation returns a constant -1 for most native API failures. Missing paths, denied access, invalid handles and sharing violations lose their identity before reaching callers. Substituting raw -GetLastError() everywhere would also be insufficient: Win32 codes and the portable errno domain are not interchangeable.

Source evidence at the head of #520:

• std/sys/fs.wave:20 — // results on success
• std/sys/windows/fs.wave:104 — pub fun open
• std/sys/windows/fs.wave:162 — pub fun read

Acceptance:

• Capture GetLastError immediately after each failed filesystem API, before cleanup can overwrite it.
• Centralize translation to the existing portable error convention; retain useful native detail where the error representation supports it.
• Exercise missing file, denied operation, invalid handle and sharing conflict on native Windows; distinguish the returned errors.
• Use native Windows APIs; do not add libc bindings.

Related: #385 is the provider umbrella; #508 concerns network errors and does not cover filesystem failures.

Audit status: identified by static source inspection; the scenarios above have not been executed during this audit. The permalink fixes the reviewed revision; this report does not claim the defect was introduced by #520.