docs: document error kinds, typed-error rules, and the decode-tolerance policy

[Greg Lamberson (glamberson)]

STYLE.md's error handling section documents the message-formatting conventions but predates two rounds of change in the machinery itself, and it says nothing about the decode-tolerance convention that this month's merges made the most exercised rule in ironrdp-pdu. This adds three subsections, plus two mirroring bullets in AGENTS.md's Key Style Conventions.

Choosing an error kind: the structured DecodeErrorKind/EncodeErrorKind variants carry byte offsets and are constructed through the *_err! macros with in: src; Other is the deliberate offset-less kind for non-stream failures (constructors, conversions, state validation).

Error types: typed errors rather than anyhow in library crates, and no proc-macro error derives in core-tier crates, hand-rolling Display and Error per ironrdp-error's own Location-capturing Source pattern.

Decoding unknown values: the taxonomy the recent interop line converged on. Peer advertisements decode with from_bits_retain (unknown bits kept, never fatal, byte-identical re-encode); negotiation outputs the receiver must implement stay strict; structural discriminants stay strict per the specifications' own drop-the-connection language. Precedent: #1144 established retain crate-wide, #1489, #1458, #1536, #1541, #1837, and #1843 through #1847 applied the taxonomy field by field, and #1845 documents the strict half in-code at the server-selected encryption method.

Deliberately out of scope: connector-layer error types, which #1751 and the sequence-contract stack are actively reshaping; nothing here describes them. Testing guidance is also untouched; that conversation belongs with the in-flight test-centralization series.

cargo xtask check fmt/lints/tests/typos/locks all pass (docs-only change).