Robust failure reporting mechanism for VM and syscalls

[anorth]

VM syscalls and other methods by which actor code interacts with its environment may generally fail for two different types of reason:

• a predictable and deterministic reason such as misuse by actor code or a caller
• an unpredictable, non-deterministic reason such as a local disk or memory error

The former type is be handled by the actor code explicitly, but the latter should not be as it cannot lead to convergence on the resulting state. Instead, VM processing must halt and the node decide what to do with this failing state.

Right now, we use panics for the latter to avoid accidentally indicating state convergence, which the VM catches. These panics are not all obvious at their place of raising and it would be easy to accidentally return an error value for a case that should not error.

We need a more robust, preferably type-checked mechanism for distinguishing and explicitly handling such error propagation (the VM internally may still use panic as a control flow mechanism, but code outside the VM context itself shouldn't know or care).