When walking the ancestor chain, a `.cade` that fails to parse now caps
the cascade at that dir instead of being silently climbed past to a valid
parent. This keeps the chain-shape decision aligned with activation, which
re-reads the same file via `config_keywords` and surfaces the parse error
there: without the cap, chain construction would build a shape that quietly
ignored a broken `.cade`, then activation would fail (or compose a parent
the user never expected) on the very same file.

The cap reuses the single per-dir parse already performed for `disinherit`
detection (`caps_the_cascade`), so no extra read is introduced. Behavior is
identical to disinherit's cap: the malformed dir itself still joins as the
chain root (its error surfaces at load), and gap-fill anchors on it without
ever reaching above.

Split out of the disinherit feature commit so this policy change lands with
its own rationale and tests.