nvx-rs slimming 4.3.3: the error codes are private #1126

Parent: #1088, in #1076. Needs: #1124, #1125. Unblocks: #1130, #1131, #1132. No PR of this group merges before the API-ready commit.

Goal. Callers tell nvx's errors apart by their kinds. ErrorCode, Error::code and Error's constructors become crate-private where they are, so nvx alone makes its errors; codes that nothing produces any more go, and the CLI keeps printing each error's code.

PRs, in order. Each PR has one goal, leaves dev green, and names in its description each old test of its area as kept, rewritten or retired, with each change that check_test_changes.py reports. Its tests follow the repository's test layout: a module's unit tests, and the code that only they use, sit in its tests.rs or tests/ and move with it. The estimates count core lines (code, not comments, docs or tests) and counted files; each PR records its measured values. Each PR does what its Scope says and no more: a case, input or layout that its Scope doesn't name, and whatever "Not in this PR" lists, is out of scope. Address every review comment within the scope, and ask before acting on one that asks for more. A PR whose measured core lines pass the stop that its Estimate names (twice the estimate, at most 600) stops and asks before continuing.

1. SL6.8c: Callers tell nvx's errors apart by their kinds; the error codes are private.
   • Objective: Callers need only an error's kind, message and source to act on nvx's failures. The stable codes serve the CLI's output, and the public constructors let any caller fabricate nvx's errors. This PR makes both private, so nvx alone makes its errors, and its public error is Error, ErrorKind and Result.
   • Contents: ErrorCode, Error::code and Error's constructors (new, one per kind, and with_source) become crate-private where they are: callers read kind(), message(), into_parts() and the source, and only nvx makes its errors. The docs of Error, ErrorKind and into_parts stop naming codes. Codes that nothing produces any more go as the compiler finds them. The CLI keeps printing each error's code, with the same messages and exit statuses. An integration test that reads a code reads the kind or the CLI's output instead. The API snapshot drops the codes and the constructors.
   • Scope:
     • ErrorCode, Error::code and Error's constructors, new, one per kind and with_source, become crate-private where they are.
     • Error keeps kind, message, into_parts, its display and its source; ErrorKind keeps its variants, as_str and its display.
     • The docs of Error, ErrorKind and into_parts stop naming codes, and codes that nothing produces any more go as the compiler finds them.
     • The CLI keeps printing each error's code, with the same messages and exit statuses.
     • An integration test that reads a code reads the kind or the CLI's output instead, and the API snapshot drops the codes and the constructors.
   • Not in this PR:
     • Changing any error's kind, message or source, or adding kinds: callers keep what they act on.
     • Redesigning CLI diagnostics, exit statuses or error serialization.
     • A public constructor or code accessor kept for compatibility: a caller that built or matched nvx's errors uses its own.
     • Moving the CLI's private error code or adding another error facade.
     • Error types per module: the host's functions keep the errors that they return.
   • Approach: Narrow the visibility of the code type, the code accessor and the constructors in place, and fix the imports that this forces. Let the warning-denied builds of each feature set find the codes and helpers that only tests used, and delete them. Convert any integration test that reads a code, keep the CLI's mappings, and regenerate the API snapshots.
   • Done when:
     • nvx exports Error, ErrorKind and Result, and neither ErrorCode nor a public constructor or code accessor.
     • No production code keeps an unused code or helper of the error module.
     • The CLI returns the same exit code and message, with the same printed code, for each covered error.
     • Every feature combination compiles, and the API snapshots show only the narrowed error surface.
   • Needs: SL6.4, in nvx-rs slimming 4.3.1: image staging, artifact discovery, the policy-file reader and the mount syntax are private to the CLI #1124; SL6.5b, in nvx-rs slimming 4.3.2: path rules are private to the CLI, and the export holds paths only #1125; SL6.7b, in nvx-rs slimming 4.3.1: image staging, artifact discovery, the policy-file reader and the mount syntax are private to the CLI #1124.
   • Estimate: 0 core lines (visibility), no counted files.

Tests. The CLI's exit statuses, messages and printed codes stay the same, and an integration test that read a code reads the kind or the CLI's output. The API snapshot drops the codes and the constructors, and every feature set passes without unused private code.

Done when: every PR above has merged, with dev green.