engine: decide whether emitters run on a document with error diagnostics, and give the engine the fatality rule #957

Problem

emitter-design §2 says the engine decides fatality and makes Generate total. At c387e25c the engine never reads Severity:

• engine.Run returns a document with error diagnostics and a nil error;
• RunOptions has no fail-on setting;
• the one severity-to-exit rule is the CLI's --fail-on (cmd/morphic/compile.go).

An embedder can only test Result.Document == nil or call ir.HasError. The emitter driver the engine will host has no rule to follow.

It matters at once on the golden spec, the Cloudflare API schema (cloudflare/api-schemas openapi.json at 911ad78). It compiles to a complete document with 4 error diagnostics: security requirements naming undeclared schemes, whose operations then read as inheriting the service default (#633). It exits 1 at the default --fail-on. Across 1,841 compiled corpus specs, 333 (18%) also exit 1 with a document.

architecture.md §2.2's "structural errors here are fatal" describes a stop the engine never makes.

Direction

A proposal: settle three questions before the emitter driver is written.

1. Does Generate run on a document with error diagnostics? The options are always, never, or above a threshold the caller chooses (cli+engine: let a caller lower the severity of parser findings that don't affect lowering #691 asks to let a caller lower parser findings).
2. Where does the threshold live? Either a RunOptions field or a Result method that the CLI and future drivers share, so the CLI's --fail-on becomes a flag over it.
3. What is "fatal" in architecture.md §2.2 when it means a run that still returns a document?

Done when the answers are in emitter-design §2 and architecture.md, and the engine API carries the rule the CLI holds alone today.

Out of scope

Rendering and writing (#958), and the operations' auth (#633).

Related: #691, #633, #958

Priority: P1, rule 5 (direct impact: a pipeline decision that decides whether the golden spec's document reaches an emitter at all). go run ./cmd/morphic compile openapi.json -o golden.ir.json; echo $? → 1, with 4 error openapi/unresolved-ref lines and a complete document written (spec @911ad78, morphic @c387e25c).