Keep the first decode error in sandboxwire.Decoder

[SaladDay]

B4 simplicity audit, lane L1, PR b. There is no wire change, and every golden fixture is byte-identical. Net −215 production lines and −92 test lines.

• One decoder. sandboxwire.Decoder now keeps the first error: later reads return zero values, and Err/Finish return that first error. The primitives return values only.
  • Deleted: the four per-protocol reader adapters in sandboxfs, sandboxprocess, sandboxlink and sandboxnet, which each re-implemented this, and Decoder.Remaining, whose only user was a test.
  • Kept local: protocol enum checks, bounded counts and Link's Hello version handling.
  • processshim/ipc.go decodes the same way. Its error texts and validation order are unchanged.
• One fixture reader. The stdlib-only package internal/sandboxwire/sandboxwiretest (ReadHex) replaces six copies of the annotated-hex reader.

Testing:

• During development, the old and new decoders were fuzzed against each other for 90 s per protocol, about 39–133 M executions each, covering Link, Network, Process, File and the three shim decoders. Errors, their classification and the decoded messages were identical.
• All decode tests and fuzz seeds, plus each fuzz target for 15 s.
• The tests of every importing package, after the rebase onto Correlate Link handshake replies #453.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}