Error plan

This commits our conclusions from the pad we created in response to #247 (closed) and !241 (closed)

By and large it was possible to simply fold everyone's opinions into unified declaratory statements. I took the liberty of making my InternalError idea firm here, since @eta liked it.

There is one remaining area where I retained individual's views, namely the precise set of error kinds. I think we can defer these details until seeing actual MR(s) which actually need them. And, as I said on IRC, once we have a first cut we can get some external review. Until we have declared the API stable, restructuring error kinds is quite easy.