fix!(ltk_ritobin): half-open spans and balanced visitor unwinding

[Crauzer]

Two breaking semantic fixes to the CST layer plus two small walk features, split out so they land ahead of the Locator/Visitor API work (#176, #175) that builds on them. No file overlap with feat/ptch-resolve, which can rebase cleanly after this merges.

Span semantics

• Span::contains is now half-open, matching intersects (the ltk_ritobin: Add Locator API #176 checkbox): a boundary offset belongs to exactly one of two adjacent spans, and empty spans contain nothing. No in-crate caller relied on the inclusive end; downstream (LSP) finders should re-check boundary handling.
• Parser "expected ..." error spans are clamped to the source instead of pointing one byte past EOF.

Visitor walk semantics

• Visit::Stop now unwinds: exit_tree runs exactly once for every entered node, innermost first, wherever the Stop came from (enter_tree, visit_token, a descendant, or exit_tree itself). Previously open ancestors skipped their exits, corrupting downstream scope stacks - the bug noted in ltk_ritobin: Add Locator API #176.
• Visit::Skip is scoped per callback: from enter_tree it skips the node's children, from visit_token the node's remaining children, and from exit_tree it prunes the parent's remaining children - the sibling-skip that used to happen by accident is now a documented semantic.
• Cst::walk reports how it ended: WalkOutcome::{Completed, Stopped}, so finders that Stop on success no longer need a found-it flag.
• Walk internals now run on ControlFlow<Unwind>, and the printer stops writing after its first error.

[alanpq]

Can we add a Visit::Abort that has the original no-unwind behaviour, and an Aborted outcome as well