feat(errors): the one-enum error family with altitude discipline

- src/error.rs: thiserror Error enum with the five ADR-012 \u00a76.5
  variants (Missing, Verification, Io(String), GcRefuse, KeyInvalid);
  doc comments carry store-api.md \u00a7Error model's semantics and the
  one-enum/two-altitude discipline (trait's effective members are
  Missing/Verification/Io/KeyInvalid; facade re-exposes with GcRefuse)
- no #[non_exhaustive] per the ADR-pinned variant set; Error derives
  Debug/PartialEq/Eq
- lib.rs re-exports Error
- unit tests: variant construction, the single-enum altitude shape,
  and the Missing-is-never-get/stat-absence doc contract (facade
  behavioral enforcement lands in wave 2)
- tasks/core-error-model.md: status completed; Notes + Summary filled

Verified: cargo test, cargo clippy --all-targets -- -D warnings,
cargo fmt --check

tasks/core-error-model.md

@@ -1,7 +1,7 @@
 ---
 id: core-error-model
 name: Error model — the one-enum family with altitude discipline
-status: pending
+status: completed
 depends_on: [scaffold-crate-features]
 scope: single
 risk: low
@@ -50,14 +50,14 @@ posture on alkstore's error taxonomy).
 
 ## Acceptance Criteria
 
-- [ ] `Error` enum with the five variants, thiserror-derived
+- [x] `Error` enum with the five variants, thiserror-derived
       Display/Error impls
-- [ ] Doc comments on the enum and each variant stating the semantics
+- [x] Doc comments on the enum and each variant stating the semantics
       and the altitude discipline verbatim-traceable to store-api.md
-- [ ] Unit tests: each variant constructs; `Missing` documented
+- [x] Unit tests: each variant constructs; `Missing` documented
       get/stat exclusion stated in docs (behavioral enforcement lands
       with the facade in wave 2)
-- [ ] `cargo test`, `cargo clippy --all-targets -- -D warnings`,
+- [x] `cargo test`, `cargo clippy --all-targets -- -D warnings`,
       `cargo fmt --check` green
 
 ## References
@@ -67,8 +67,35 @@ posture on alkstore's error taxonomy).
 
 ## Notes
 
-> To be filled by implementation agent
+- Implemented as a *single* enum carrying the altitude discipline in
+  doc comments (module doc, per-variant docs, and a
+  `one_enum_both_altitudes` test asserting the 4-member trait-shape
+  vs 5-member facade-shape split) — the reading recommended by the
+  task's named design point. Payloads verbatim: only `Io(String)` is
+  annotated with a payload in store-api.md/ADR-012 §6.5; `Missing`,
+  `Verification`, `GcRefuse`, `KeyInvalid` are the unit variants the
+  spec text itself writes, so no payloads were invented for them.
+- `#[non_exhaustive]` not applied per the task's ADR-pinned variant
+  set. `Error` derives `Debug`/`PartialEq`/`Eq` (test/ctor utility;
+  no behavior added).
+- Re-exported as `pub use error::Error` from `lib.rs`; module remains
+  public per the scaffold shape.
+- The `missing_is_exclusive_to_err_shaped_ops` test is the marker for
+  the get/stat-exclusion doc contract; behavioral enforcement is
+  deferred to the wave-2 facade task, as scoped.
 
 ## Summary
 
-> To be filled on completion
+`src/error.rs` now defines the crate's error family: one
+thiserror-derived `Error` enum with exactly the five distinguished
+variants (`Missing`, `Verification`, `Io(String)`, `GcRefuse`,
+`KeyInvalid`), doc comments traceable to store-api.md §Error model and
+ADR-012 §6.5/§1 stating each variant's semantics plus the one-enum/
+two-altitude discipline (trait boundary: `Missing`/`Verification`/`Io`/
+`KeyInvalid` effective; `KeyInvalid` never fires at the boundary,
+`GcRefuse` never fires below the facade — the facade re-exposes the
+family with `GcRefuse` added). Re-exported from `lib.rs`. Three unit
+tests cover variant construction, the single-enum altitude shape, and
+the `Missing`-is-never-`get`/`stat`-absence doc contract. Verified:
+`cargo test`, `cargo clippy --all-targets -- -D warnings`, `cargo fmt
+--check` all green.