fix(io): a halted fsync is recognisable as a halt, not a hard failure

The three bounded-fsync failures returned bare io::ErrorKind values —
TimedOut, Interrupted, Other/EIO. `is_halt()` matches on
`io_error_code(e) == Some(E_HALTED)`, i.e. the "E<code>" prefix that
`From<Error> for io::Error` mints, and that is documented as the ONLY
recognised shape. A bare ErrorKind carries no prefix.

So cancelling a rip while sync_all / finish was inside the bounded fsync
made `is_halt()` return false, and the CLI reported a clean user cancel
as a hard I/O failure at the end of an otherwise complete mux.

All three were also mutually unclassifiable, which is the same
information-loss the numeric-code scheme exists to prevent: a caller
could not tell "cancelled" from "NFS wedged" from "worker died", and
should not retry the third the way it retries the first. And their
Display text is std English — "timed out", "operation interrupted" —
reaching a user from library code, which this crate does not do.

Now Error::Halted, Error::SyncTimeout (E_SYNC_TIMEOUT 9056) and
Error::SyncWorkerLost (E_SYNC_WORKER_LOST 9057), on both platforms.

E_HALTED also now maps to ErrorKind::Interrupted rather than falling into
the 6000..=6999 InvalidData bucket. A stop is an interruption, not
invalid data. Nothing branched on the old kind — every consumer uses
is_halt() — so this is safe as well as more accurate.

Two things worth recording. I first placed the E_HALTED arm AFTER the
6000..=6999 range arm and wrote a comment claiming it preceded it; match
arms are ordered, so the range won and the comment was simply false. The
test caught it. And the macOS test asserted only that each arm was
non-Ok with a particular ErrorKind — it passed throughout the period the
three were indistinguishable. It now asserts they can be TOLD APART,
which is the property that actually matters.

Found by the round-9 opus escalation over the API contract.

src/io/writeback_file/linux.rs

@@ -149,14 +149,14 @@ fn bounded_failure_to_result(e: crate::io::bounded::BoundedError) -> io::Result<
                 target: "mux",
                 "WritebackFile::sync_all fsync timed out after 60s; data NOT durably flushed, kernel will flush on close"
             );
-            Err(io::Error::from(io::ErrorKind::TimedOut))
+            Err(crate::error::Error::SyncTimeout.into())
         }
         crate::io::bounded::BoundedError::Halted => {
             tracing::warn!(
                 target: "mux",
                 "WritebackFile::sync_all fsync skipped (halt requested); data NOT durably flushed, kernel will flush on close"
             );
-            Err(io::Error::from(io::ErrorKind::Interrupted))
+            Err(crate::error::Error::Halted.into())
         }
         crate::io::bounded::BoundedError::WorkerLost => {
             tracing::error!(
@@ -166,7 +166,7 @@ fn bounded_failure_to_result(e: crate::io::bounded::BoundedError) -> io::Result<
             // EIO, matching the macOS sibling: a consumer distinguishing these
             // three failures does so on the same value on every platform.
             // ErrorKind::Other carries nothing a caller can branch on.
-            Err(io::Error::from_raw_os_error(libc::EIO))
+            Err(crate::error::Error::SyncWorkerLost.into())
         }
     }
 }