Ensure lenient navigation

[MaddieM4]

Part of the new design is that we don't break a document for having bad events. We apply parent events transactionally and ignore failures.

This means we need tests to confirm that when applying the (bad) history of an event:

• We have a good error reporting mechanism.
• We continue over bad events, even consecutive ones.
• We do not persist half-states from partially successful events.

This should be a pretty straightforward test-then-fix ticket, although it will most likely force some API changes.

[MaddieM4]

API changes:

• Event.Goto() should return []error, not error.
• Event.Apply() should be transactional, returning an error if rollback was necessary.

[MaddieM4]

Event.Apply happens to be atomic already. Will work on multi-primitive cases in a separate ticket.