Type bare unsafe Err as string, not Infer

[samifouad]

Closes dsc#103. Tracked under dsc#90 — no unchecked value without an explicit boundary contract.

What

Bare unsafe { } types as Result<Infer, string> instead of Result<Infer, Infer>.

The Err side was Infer, which accepts any member access. So this compiled and evaluated .message on a string:

const result = unsafe { deka.ui.renderToString(tree) }
match (result) {
  Err(e) => echo(e.message),   // undefined
}

dsc#102 fixed dsc#60 at the payload — the emitter normalizes a bare-unsafe Err to the thrown value's string representation, so errors-as-values holds at runtime. This makes the checker agree with the runtime, which is what turns the mistake into a check-time error with a span rather than a silent undefined.

Call sites

Every Err(e) => e.message migrated to Err(e) => e across the testsuite, the tour, and the fixtures.

Nothing caught these before. They are all .pass fixtures whose Err arm never executes, so the suite stayed green while every one of them would have printed undefined instead of the diagnostic it exists to surface.

Unchanged

The annotated form. unsafe<T> { } keeps Result<T, JsError> and its Error-object payload — sound, because the JsError member table (.message, .name) describes a real Error.

Scope

One step of the deka#252/#460 mandatory-annotation migration, not the whole thing.

Note on authorship

This is kimi's work. Its dispatch ended before it could commit — the second time that has happened — so I reviewed the diff and committed on its behalf. The checker change and all 30 call-site migrations were complete and consistent.

-kimi