iter design-md-rolesplit.1 (DONE 9/9): DESIGN.md -> design/ ledger role-split

The 3020-line docs/DESIGN.md is replaced by the design/ ledger:
design/INDEX.md (sole addressable spine, typed Contracts+Models tables,
polymorphic links — prose file OR authoritative source //!), 14
design/contracts/*.md test-linked invariants + 3 source-link-only
contracts (mangling/env-construction/qualified-xref, no prose file —
code is SoT), 5 design/models/*.md whitepapers, and
docs/journals/2026-05-19-design-decision-records.md (the
relitigation-guard archive — every why/rejected/does-not-do/rollback/
empirical ### moved out at ###-granularity). Clean cut: git rm
docs/DESIGN.md, no stub.

RED-first crates/ailang-core/tests/design_index_pin.rs — the 4-clause
anti-regrowth spine (DESIGN.md-gone / every-INDEX-link-resolves /
every-contract-names-a-resolvable-ratifier /
contracts-carry-no-decision-record-prose) — demonstrably RED before,
GREEN after. Build-atomic by task ordering: design_schema_drift.rs's
include_str! (the only compile-time consumer) retargeted to
design/contracts/data-model.md BEFORE the deletion; its
## Data model/## Pipeline slicer dropped (a simplification the split
enables). 2 NoInstance diagnostics + 2 lockstep E2Es retargeted to
design/contracts/{float-semantics,typeclasses}.md. ~12 agent reading
lists + 5 SKILL bodies + CLAUDE.md + skills/README.md + ~25
code/C/.ail/spec comment xrefs retargeted; OQ7 dangling 'Iter 13b'
cite deleted (no forward target — a pointer would be fiction).
honesty-rule.md rewritten so the rule names the new home
(rationale->journals), resolving the recon-found internal
contradiction; the two docs_honesty_pin.rs:70,72 pinned phrases kept
verbatim+contiguous.

Boss-verified independently: cargo test --workspace 646 passed /
0 failed; design_index_pin 4/4; acceptance grep CLEAN of live
DESIGN.md refs (residuals = only the spec-mandated clause-4
deletion-enforcer). 2 DONE_WITH_CONCERNS routed to the mandatory
milestone-close audit: (a) str-abi.md:23 '(iter str-concat,
2026-05-13)' provenance stamp trips advisory architect_sweeps Sweep-1
— Boss-confirmed byte-identical to DESIGN.md@deeffb1:2062-2065, a
faithfully-migrated PRE-EXISTING anchor (regexes verbatim, only path
retargeted), NOT split-introduced — RATIFY-or-tidy at audit; (b) a
now stale-direction intra-prose 'see Str ABI below' cross-ref in
float-semantics.md — audit-adjudication candidate. Plan defect noted:
Task 9 Step 4's verbatim acceptance grep used a ^./ anchor not
matching the system's grep -rIn output; substance re-verified CLEAN.

Spec grounding-check PASS x2. Journals INDEX + decision-records
pointer appended (Boss-only).

crates/ailang-check/src/lib.rs

@@ -446,7 +446,7 @@ pub enum CheckError {
 
     /// An `(export …)` fn has a parameter or return type that is not
     /// a permitted embedding-ABI type. The embedding ABI is frozen as
-    /// of M3 (DESIGN.md §"Embedding ABI" > "Frozen value layout"):
+    /// of M3 (design/contracts/embedding-abi.md):
     /// `Int`/`Float` or a single-constructor record of those; every
     /// other shape (multi-ctor sums, `Str`/`List`/nested-record
     /// fields) is rejected at typecheck (the feature-acceptance
@@ -858,7 +858,7 @@ impl CheckError {
         }
         // Iter 23.5: Float-aware addendum on `NoInstance`. When the
         // unresolved class is `Eq` or `Ord` AND the type is `Float`,
-        // append a cross-reference to DESIGN.md §"Float semantics" so
+        // append a cross-reference to design/contracts/float-semantics.md so
         // the LLM author learns the partial-Float story immediately
         // rather than seeing a bare "no instance" message. Float has
         // neither Eq nor Ord by design (partial orderability per
@@ -871,7 +871,7 @@ impl CheckError {
             if (class == "prelude.Eq" || class == "prelude.Ord") && at_type == "Float" {
                 d.message = format!(
                     "{} — Float has no Eq/Ord instance by design (partial \
-                     orderability per IEEE-754); see DESIGN.md §\"Float semantics\".",
+                     orderability per IEEE-754); see design/contracts/float-semantics.md.",
                     d.message
                 );
             } else if class == "prelude.Show" {
@@ -879,14 +879,14 @@ impl CheckError {
                 // for any type lacking a Show instance — most commonly
                 // a function type (`print f` where f is bare-fn-typed)
                 // or a user type the LLM-author forgot to give an
-                // instance for. Cross-references DESIGN.md §"Prelude
-                // (built-in) classes" so the author learns which types
-                // ship with built-in Show immediately.
+                // instance for. Cross-references
+                // design/contracts/typeclasses.md so the author learns
+                // which types ship with built-in Show immediately.
                 d.message = format!(
                     "{} — `print` and `show` require a Show instance. \
                      Built-in Show ships for Int, Bool, Str, Float in \
-                     the prelude; see DESIGN.md §\"Prelude (built-in) \
-                     classes\". User types declare their own \
+                     the prelude; see design/contracts/typeclasses.md. \
+                     User types declare their own \
                      `instance prelude.Show <T>` in the type's defining \
                      module per Decision 11 coherence.",
                     d.message
@@ -2644,7 +2644,7 @@ fn constraint_type_matches(declared: &Type, residual: &Type) -> bool {
 /// Decision 8.
 ///
 /// `is_tail` is the tail-context flag for the term currently being
-/// visited. The propagation rules (from DESIGN.md Decision 8):
+/// visited. The propagation rules (from design/contracts/tail-calls.md):
 ///
 /// - The body of a fn / Lam is visited with `is_tail = true`.
 /// - `Match { scrutinee, arms }`: the scrutinee is **not** in tail
@@ -6333,8 +6333,8 @@ mod tests {
 
     /// Floats milestone post-fieldtest B1 (RED): pattern-matching on a
     /// `Literal::Float` literal must be hard-rejected at typecheck via
-    /// `CheckError::FloatPatternNotAllowed` per DESIGN.md §"Float
-    /// semantics" — even when the match arm reaches `check` through
+    /// `CheckError::FloatPatternNotAllowed` per
+    /// design/contracts/float-semantics.md — even when the match arm reaches `check` through
     /// the *full* check pipeline (which runs `desugar_module` first).
     ///
     /// The existing `reject_float_pattern_in_match` test in