OnError is an ErrorOption, shared by Restart and Retry

[pior]

OnError moves into the shared error policy and returns an ErrorOption, like ErrorLimit. Restart now takes it too.

• Restart calls it with each error, including the last one returned at the error limit, the same as Retry.
• Source compatible: ErrorOption embeds RetryOption, so existing Retry(r, OnError(fn)) calls still compile. Only code that names the old func(func(error)) RetryOption type breaks.
• This makes OnError a shared name on purpose, which satisfies the AGENTS.md naming rule.