fix error handling bugs in reader.WriteTo

- r.err is checked before r.WriteTo begins writing. This avoids writing
  corrupt data to the io.Writer.

- r.err is set when decoding errors occur in r.WriteTo. A copyWriter
  type is introduced to let r.WriteTo distinguish decoding errors vs
  write errors and allow reading to safely resume after a write error
  occurs.