Domain error types and the §8 exit-code map.
Variants carry enough context for the user to diagnose without
reading source: which URL was being fetched, which sha was
expected vs received, which trust root was loaded. The runtime
wires color_eyre so the chain renders top-to-bottom.