Returns errors as data from parsing and XPath

[redvers]

Closes #17 and addresses review H10. Replaces the partial-function error-signalling on the parsing and XPath surface with union returns that carry an Xml2Error value alongside the success type.

API changes

Removed:

• Xml2Doc.parseDoc(...)?
• Xml2Doc.parseFile(...)?

Added:

• Xml2Parser.parseDoc(xml, options): (Xml2Doc | Xml2Error)
• Xml2Parser.parseFile(auth, path, options): (Xml2Doc | Xml2Error)
• Xml2Doc._from_ptr(...): package-private constructor used by Xml2Parser

Changed signatures (now return union with Xml2Error):

• Xml2Doc.xpathEvalNodes / String / F64 / Bool
• Xml2Node.xpathEvalNodes / String / F64 / Bool

Xml2XPathResult gains an Xml2Error variant; empty nodesets now return an empty Array[Xml2Node] rather than None (closes review M2).

Xml2Error refactor

class val with let fields throughout; safe to share across actors.

• domain: Xml2ErrorDomain (typed primitive union over libxml2's ~31 documented domains plus an Unknown fall-through)
• level: Xml2ErrorLevel (None / Warning / Error / Fatal / Unknown)
• from_last_error()?: partial constructor reading libxml2's per-thread state; raises when no error is current rather than fabricating one
• _synthetic(...): package-private constructor for the impossible case where libxml2 reports a parse failure but xmlGetLastError returns null; lets the public union return types stay total
• string(): human-readable rendering for logging

Xml2Parser captures errors eagerly on the same Pony behaviour as the parse call, so callers receiving the union don't have to worry about libxml2's thread-local last-error state surviving actor migration.

Tests

TestParseError now asserts on the error fields directly: the prior "non-deterministic" caveat is gone because Xml2Parser delivers the error of this parse, not whatever happens to be in TLS later.

Added:

• xml2doc/parse-error (rewritten with real assertions)
• xml2error/string-rendering
• xml2error/domain-mapping
• xml2error/level-mapping

All other tests migrated mechanically to the new APIs:
Xml2Doc.parseDoc(...)? -> Xml2Parser.parseDoc(...) as Xml2Doc
doc.xpathEvalNodes(q)? -> doc.xpathEvalNodes(q) as Array[Xml2Node]
etc.

README example updated to the new union shape.

Counterfactual: replacing _capture_error to always synthesise (i.e. ignore libxml2 last-error) fails parse-error and string-rendering tests, confirming the rich-error path is on the hot path and not silently shadowed by the synthetic fallback.

61/61 tests pass.

Deferred to follow-up

• xmlSetStructuredErrorFunc callback installation (per-thread buffer + module-init timing; overlaps review H5)
• xmlXPathOrderDocElems / xmlXPathTreeOrder (the secondary item on issue 6. Performance and error handling hooks #17)