remove error enum #35693

Validation functions previously signalled fatal/internal errors by
setting an `M_ERROR` mode on the BlockValidationState out-parameter,
which tangled three outcomes (valid / invalid / fatal) in a single
object and forced callers to unwrap them.

Introduce `kernel::FatalError`, which can only be created through
`FatalError::Raise()`. Raise() fires the fatalError notification and
returns the error wrapped in `util::Unexpected`, so holding a FatalError
proves the notification fired exactly once; propagation up the stack
just moves the object.

Convert the block processing chain to return `util::Expected<T,
kernel::FatalError>`, where the error channel carries the fatal error
and the value channel carries the `BlockValidationState`
(valid/invalid) or void. `BlockManager::WriteBlock` and
`FindNextBlockPos` now mint the error at the true origin instead of
returning a null FlatFilePos after firing the notification.

`Chainstate::DisconnectTip` and `Chainstate::InvalidateBlock` keep a
plain string error channel because they mix outcomes: DisconnectTip
failures are escalated to a fatal error by ActivateBestChainStep but
surfaced as a plain error by InvalidateBlock (matching the previous
AbortNode-at-caller behaviour), and InvalidateBlock mixes user errors
with propagated fatal messages.

The BlockChecked validation interface signal is now fired only for
valid/invalid outcomes, never on a fatal error. Observable behaviour is
otherwise unchanged: fatal errors keep mapping to the same RPC error
codes as before, and the Mining interface's checkBlock/submitBlock
surface the fatal message as the reject reason as before. The one
exception is the internal-bug guard in ActivateBestChain
(m_target_utxohash set), which now raises a fatal error instead of
returning a plain string, since continuing to operate that chainstate
would corrupt state.

A fatal error (disk failure, block data corruption, ...) is a failure of
the node itself, not a verdict on the RPC's inputs, and the node is
already shutting down by the time it is reported. Previously these
errors were conflated with block validation failures: submitblock and
getblocktemplate reported them as RPC_VERIFY_ERROR; preciousblock,
invalidateblock and reconsiderblock as RPC_DATABASE_ERROR; and
generatetoaddress/generatetodescriptor flattened them into the generic
"ProcessNewBlock, block not accepted" error.

Add a ThrowFatalError() helper and use it at every RPC call site that
receives a kernel::FatalError, so all of them consistently fail with
RPC_INTERNAL_ERROR and the fatal error message.

Now that fatal errors are propagated through util::Expected's error
channel, no validation code sets or reads the `M_ERROR` mode. Drop
`Error()`, `IsError()` and the `M_ERROR` enumerator so that a `ValidationState`
can only be valid or invalid.