errors: AST linter check_error_codes (raise + registry enforcement)

[AbdelStark]

Re-opening with base=main since the original PR (#104) was closed when its base branch was deleted on merge of #103.

Problem

RFC-0012 §3.3 and RFC-0015 §3.4 require two AST checks at PR time:

• raise_geno_lewm_error — raise X(...) in geno_lewm/ only raises GenoLeWMError subclasses.
• registered_error_code — the raised class is one of the leaves listed in ERROR_CODES.

Solution

• tools/lint/check_error_codes.py — parses geno_lewm/errors.py with ast to derive the legal class set (no runtime import dependency); walks targets; flags non-registered raises with GitHub-Actions-friendly diagnostics.
• tests/lint/test_check_error_codes.py — 19 cases covering bare re-raise, Name/Attribute raises, builtin raises (parametrized over 6), raise … from, syntax errors, and the self-skip on errors.py.
• .github/workflows/lint-errors.yml — standalone per-PR workflow; designed to fold into testing: implement GitHub Actions per-PR CI workflow #86's full CI when that lands.

Validation

$ python -m tools.lint.check_error_codes
$ echo $?
0

$ python -m pytest tests/lint/ tests/unit/ -q
144 passed in 0.09s

Caveats

• The linter rejects raise GenoLeWMError(...) because the root class is not in ERROR_CODES. Intentional — RFC says leaf classes only.
• Name-based whitelist (not type-resolved). False positives only on dynamic raises (raise cls(...)).

Closes #22