Preserve and classify native Windows filesystem errors

The portable filesystem entry point promises negative errno-style failures, but the Windows implementation returns a constant `-1` for most native API failures. Missing paths, denied access, invalid handles and sharing violations lose their identity before reaching callers. Substituting raw `-GetLastError()` everywhere would also be insufficient: Win32 codes and the portable errno domain are not interchangeable.

Source evidence at the head of #520:

- [std/sys/fs.wave:20](https://github.com/wavefnd/Wave/blob/2ae0a91c57fd76323124c0e4dff552adbfadbe1b/std/sys/fs.wave#L20) — `// results on success`
- [std/sys/windows/fs.wave:104](https://github.com/wavefnd/Wave/blob/2ae0a91c57fd76323124c0e4dff552adbfadbe1b/std/sys/windows/fs.wave#L104) — `pub fun open`
- [std/sys/windows/fs.wave:162](https://github.com/wavefnd/Wave/blob/2ae0a91c57fd76323124c0e4dff552adbfadbe1b/std/sys/windows/fs.wave#L162) — `pub fun read`

Acceptance:

- [ ] Capture GetLastError immediately after each failed filesystem API, before cleanup can overwrite it.
- [ ] Centralize translation to the existing portable error convention; retain useful native detail where the error representation supports it.
- [ ] Exercise missing file, denied operation, invalid handle and sharing conflict on native Windows; distinguish the returned errors.
- [ ] Use native Windows APIs; do not add libc bindings.

Related: #385 is the provider umbrella; #508 concerns network errors and does not cover filesystem failures.

Audit status: identified by static source inspection; the scenarios above have not been executed during this audit. The permalink fixes the reviewed revision; this report does not claim the defect was introduced by #520.

Start with the portable contract at std/sys/fs.wave:20 and the Windows entry points std/sys/windows/fs.wave:104 (open) and :162 (read). Trace each failed native filesystem API, preserve GetLastError before cleanup, and find the existing portable error convention before centralizing translation. Done means native Windows checks distinguish missing files, denied operations, invalid handles, and sharing conflicts without libc bindings.

Written by the indexing model from the issue text.