✨ Deliberately fail an XMD document with `<Fail>`

[taras]

Story

As an Executable Markdown author, I want to select an actionable failure in authored control flow, so abort and bounded exhaustion do not depend on a generic missing-<Return> diagnostic or a host-only branch.

<Fail message="Review aborted; nothing was saved or run." />

Contract

<Fail> is a generic first-party component.

• It is self-closing and requires a non-empty string message.
• It renders nothing, binds nothing, and declares no return value.
• When expanded, it raises an authored failure carrying that message at the invocation position.
• It performs no durable effect before failing.
• It follows the enclosing error-mode contract. In a value root, the existing throw mode makes it fail the document even if a <PrintErrors> appears outside that value body.
• Content, as, a missing message, and an empty message are refused before the failure body runs.

Suggested syntax description:

Stop authored work with an actionable failure. <Fail message="No acceptable candidate was approved." /> raises the message where it is written.

Motivation

Issue #260 moves generation, repair, human review, abort, and bounded exhaustion into a checked-in Markdown value root. The root needs to fail deliberately on abort or when its review bound is exhausted. Falling through without <Return> reports a structural accident rather than the decision the document made.

Acceptance

• A plain root reaches the authored failure and does not expand a following sibling.
• A value root publishes no value and fails with the authored message.
• A branch not taken reaches no failure.
• A loop may select the failure on exhaustion.
• Invalid invocation shape runs no authored failure body.
• Error-mode behavior follows the existing specification, including an explicitly recovering <PrintErrors> region where applicable.
• The component is documented in the syntax catalog and covered under Deno, Node and Bun through the shared corpus.

Relationship

This is a prerequisite for #260. It is generic control flow and contains no prompt-specific abort or retry policy.