[Bug]: Unknown XPC peer error codes can terminate the client

### I have done the following

- [x] I have searched the existing issues
- [x] I reproduced the issue using the current `main` branch

### Steps to reproduce

1. Construct an XPC error payload whose `code` string is not one of the error codes known by the receiving client. This can occur when a newer daemon adds an error code and an older client receives it.
2. Pass that payload to `XPCMessage.error()`.
3. Observe that `ContainerizationError.Code(rawValue:)` calls `fatalError` for the unknown string instead of returning an ordinary decoding/protocol error.

### Problem description

An unrecognised error code supplied by an XPC peer can terminate the client process. XPC data crosses a process and version boundary, so an unknown future code must be treated as malformed peer data rather than as an internal invariant violation.

`XPCMessage.error()` should validate the decoded string against its known codes and throw `.internalError` with the existing malformed-payload message when the code is unknown. Known codes and their messages must continue to round-trip unchanged.

### Environment

- OS: macOS 26.6
- Xcode: 26.6
- Container: current `main` at `eee7ad097079cc3b02d5309ec10160143f2d0c6a`

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Start at XPCMessage.error() and ContainerizationError.Code(rawValue:), then locate the existing malformed-payload handling. Verify that an unknown code throws .internalError with the existing malformed-payload message, while known codes and their messages continue to round-trip unchanged.

Written by the indexing model from the issue text.