Replace `ValidationResult | str` with a `ValidationOutcome` type

[alexhambley]

Issue

Right now, validation functions return ValidationResult | str (which is a string on error), so this means that every caller must isinstance(result, str) to detect any failures, and an error string is indistinguishable by type to a real result.