cesr-stream: low-severity API nits roundup (#193)

[joeldsouzax]

Part of #193. Low-severity public-API findings from the surface review, tracked so nothing is dropped. Each is a checkbox — split into its own issue if it grows.

• Stringly reject-path payloads — ParseError::UnknownMatterCode(String) / UnknownCounterCode(String) (error.rs:24,28) carry the code as String; defensible (genuinely-unknown bytes) but Box<str>/ArrayString avoids an alloc on the reject path. Fold into the cesr-stream: replace ParseError::Malformed(String) sink with typed #[from] source union (#193) #208 error rework.
• qb2 module-name repetition + owned returns (qb2.rs:24,55) — qb2::qb2_to_qb64 repeats the module name (→ consider qb2::to_text/from_text); both return owned Vec<u8>. A &mut Vec/writer variant lets callers reuse buffers on hot paths.
• encode_count/encode_count_auto heap-alloc per counter (encode.rs:65,79) — return Vec<u8> for a ≤8-byte counter; SmallVec/ArrayVec or write-into-buffer avoids the alloc.
• Decoder/Encoder partial-frame semantics undocumented (codec.rs:290-314) — the Ok(None) incomplete-frame behavior and V1/V2 TypeId dispatch are only implied; add a note on CesrCodec for async users.
• Redundant Cesr prefix on CesrGroup/CesrMessage/CesrEncode/CesrCodec under the crate path (cesr_stream::CesrGroup) — acceptable convention, but worth a deliberate workspace split phase 2: per-crate redesign & tightening (OWNER-DRIVEN — Joel hands-on) #193 call.
• Element assoc-types leak keripy contractions — Group<K>::iter/into_vec surface Siger/Cigar/Diger/Saider/Prefixer/Verfer/Verser/Noncer (group/kinds.rs:145-597); origin is cesr::core::primitives (fix belongs there) but they're observable in this crate's API.
• QuadletGroup::unwrap_generic eager Vec (unwrap.rs:31) — diverges from the lazy-iterator idiom (Group::iter, Frame: IntoIterator); the whole one-impl unwrap module could fold into group.
• Arbitrary root re-export split — crate root re-exports 5 group items (lib.rs:61-72) while group re-exports all 29 kind aliases (group/mod.rs:39-67); the headline-at-root vs module-only split looks unprincipled.

(Read/write V1/V2 selection asymmetry + from_sigers rename + owned-Bytes model → tracked in #210.)