Fix kb's lint warnings and retire its deferral

[williamthorsen]

Problem

kb reports 20 lint warnings across nine deferred rules and 16 files.

Context

Part of #1256.

preserve-caught-error recognizes only built-in Error constructions, so it flags 2 of the 6 kb sites
that fold a caught error's message into a new error without attaching cause. The other four throw
KbLoaderError, whose constructor takes no cause and which the README documents as part of kb's public
surface.

@williamthorsen/toolbelt.errors is published and supplies describeError and chainError from its
candidate tier, so kb adopts them rather than defining its own. It would be kb's first
@williamthorsen/* runtime dependency.

kb holds eight further copies of error instanceof Error ? error.message : String(error) outside any
throw. #1256 assigns the repo-wide sweep of these to a sibling ticket; kb's share comes forward so its
files are touched once.

extractGitErrorMessage in cli/targeting/resolve-changed-paths.ts is a superset rather than a
duplicate: it keeps its stderr branch and delegates only the fallback.

unicorn/prefer-simple-condition-first is off in the preset and re-enabled only by kb's own deferral,
so no sibling ticket has to land first. Retiring the deferral returns the other nine rules to error, so
it lands with the fixes rather than ahead of them.

Proposed solution

Attach cause at all six chained sites, not only the two the linter sees; KbLoaderError gains a cause
option to make the other four possible. Chained messages then join with : , following chainError's
shape, while kb's own composed messages keep —.

Acceptance criteria

Must have

• nmr lint:check reports nothing for kb, which retains no deferral residue: no rule list, no
  package strict-lint config, and no config reference to either.
• kb depends on @williamthorsen/toolbelt.errors and defines no message-extraction or cause-chaining
  helper of its own.
• Every kb site that folds an error into a new error attaches it as cause, including the four
  preserve-caught-error does not flag.
• Every site that gains a cause has an assertion covering it.
• Each fix that changes behavior rather than preserving it is covered by a test.
• The README's KbLoaderError description covers the cause option.