Errors crossing the plugin boundary.
Deliberately string-based rather than a rich enum: a WASM guest can only hand back bytes, so anything richer would be lossy on one side of the boundary and misleading on the other.