docs: add normative spec section for serialized error shape

[dean0x]

Location: spec.md

What: spec.md documents the lint JSON wire format (§7.5) normatively, but has no comparable normative section for the serialized error shape used by bindings (mds-napi, mds-python, mds-wasm).

Why deferred: Documentation gap, not a behavioral issue. Normative spec section for serialized error shape is a pre-existing gap clarified during review of PR #253.

Source review: .devflow/docs/reviews/fix-esc-injection-176/2026-07-25_1625 (documentation-13)

Acceptance Criteria:

• Review the current error serialization contract (see mds-core/src/error.rs)
• Document the wire format for MdsError::serialize() normatively in spec.md
• Include field names, types, and constraints (e.g., control character escaping)
• Cross-reference the sanitization rules from the lint format section
• Verify binding implementations match the spec

Related: PR #253 introduced sanitization at the error serialization boundary; the spec section should document this behavior normatively.