268f1fcc

stripe: stop at a month that will not aggregate, keep the ones before it

A month that failed to aggregate took the whole run down with it, including months
that had already reconciled on Stripe's own figures.  The importer writes its file
once, at the end, so nothing reached disk at all.

That is the opposite of what already happens for a month whose evidence is missing,
where `untilEvidenceMissing` stops the stream and lets everything before it through.
A month that cannot be aggregated wants the same treatment: every error raised there
ends in "Book this month by hand", and that is only possible if the months before it
are in the file to begin with.

## What changed

A new `untilMonthFails` conduit stage, shaped like `untilEvidenceMissing`: it yields
months while they aggregate and returns the errors of the first one that does not,
without awaiting again.  Because the pipeline is demand-driven, the months after it
are never fetched.

The pipeline uses `fuseBoth` so the sink still produces the module while the stage
reports what it stopped at, and the failure is re-raised *after* the file is written.

The run still exits non-zero, which is deliberately different from a held-back month
exiting 0: waiting on a tax invoice is routine, a month that does not reconcile is
not, and a scripted import should not mistake one for a complete run.

## How it came up

Filing 2026-Q3.  September did not reconcile by 8.10 and August was lost with it,
although nothing was wrong with August.  With this change August imports, September
still stops, and the run still fails.

## Tests

Five tests in `ImportSpec`, mirroring the `untilEvidenceMissing` block.  They were
written against a stub reproducing the old all-or-nothing behaviour first, and three
of the five failed, including "keeps the months before a failing one rather than
throwing the run away".

`nix flake check` passes.