Classify empty provider streams as retryable

[raphael]

Summary

• Introduce model.ErrEmptyStream + model.NewEmptyStreamError, pairing a detection sentinel with a retryable unavailable ProviderError (code empty_stream).
• Bedrock and Anthropic stream adapters classify a message stop without an active message — and event streams that close before any message starts — as empty streams instead of opaque protocol errors. Streams that close mid-message become retryable truncated_stream provider errors; duplicate message stops remain hard protocol errors.
• Document the provider stream integrity contract in DESIGN.md and the new sentinel in docs/runtime.md.

Rationale

Bedrock intermittently terminates ConverseStream responses without ever emitting messageStart when the model produces an empty completion (observed in production on Haiku 4.5: messageStop first, zero output tokens, reproducible per transcript). The strict state machine introduced in v0.62 correctly rejects the shape, but callers could not distinguish it from a corrupted stream, so retry middleware had nothing to key on. Adapters still never fabricate a response; retry policy stays with the integrating application.

Test evidence

• make lint: 0 issues.
• make test: full suite green.
• New coverage: processor-level empty-stream/duplicate-stop classification (Bedrock), eventless and stop-without-start streams (Anthropic), streamEndedEarlyError table test, NewEmptyStreamError contract test.