design/ ledger: dense cross-linking via three topical splits + 88-link sweep

The first formal-links milestone shipped clause-5 + 8 links across the
existing file layout. Browsing surfaced that file-only granularity is
only as precise as the file boundaries — three files mixed two or
three navigation targets under one address, so the 8 links could not
multiply without ambiguity. This commit fixes the substrate, then
applies the sweep the original milestone deferred.

Splits (each extracts an already-self-contained section into its own
file so links land on the topic, not the parent doc's TOC):

  contracts/typeclasses.md
    → +contracts/prelude-classes.md  (Eq/Ord/Show ships, polymorphic `print`)
    → +contracts/method-dispatch.md  (5-step dispatch rule, candidate index)

  contracts/memory-model.md
    → +contracts/language-constraints.md  (the 4 binding constraints
                                           making RC sound without a
                                           cycle collector)

  models/authoring-surface.md
    → +models/prose-projection.md  (Form-B / `ail prose` / merge-prose)

Each new file enters design/INDEX.md as its own row (three contracts
share show_no_instance_e2e.rs / uniqueness.rs as ratifying tests;
prose-projection is a model). Two pre-existing links rebind to the
new topic-files (memory-model.md → method-dispatch.md;
float-semantics.md → prelude-classes.md).

Link sweep: 8 → 88 formal Markdown links over 23 files. Every file
in design/contracts/ + design/models/ now has at least one outgoing
link; the tree is fully connected. Links are file-relative
`[label](path)` per the established convention, fenced code blocks
are skipped (a `](` inside ```jsonc``` is literal text), the durable
tier (design/ + crates/ + runtime/) is enforced by clause-5.

Tests:
  - design_index_pin.rs (5/5 clauses): clean-cut, INDEX resolution,
    ratifying-test resolution, no decision-record prose in contracts/,
    body links durable + resolving.
  - docs_honesty_pin.rs (5/5): one assertion rebinds from typeclasses.md
    to prelude-classes.md (where the gated sentence now lives);
    design_corpus widens to include the 4 new files so the Wunschdenken
    / doc-archaeology sweeps continue to cover everything that used to
    live in the parents.

No spec/plan/journal for this batch — interactive collaboration after
the milestone closed; the user gated the splits explicitly before the
sweep.

design/contracts/float-semantics.md

@@ -66,7 +66,7 @@ no `f32` variant. The runtime / codegen contract:
 
 The same libc-`%g` rendering applies to `show 1.5` / `show nan` /
 `show inf` via `instance Show Float` (which calls `float_to_str`
-internally — see [Prelude (built-in) classes](typeclasses.md) for the Show ship).
+internally — see [Prelude (built-in) classes](prelude-classes.md) for the Show ship).
 The NaN-spelling caveat above is observable via `do print x` for
 Float-typed `x`; the rendering is libc-version-dependent and
 target-libc-specific. AILang does NOT canonicalise Float textual
@@ -83,12 +83,16 @@ use case appears.
 
 **Form-A serialisation:** Float literals carry the IEEE-754
 bit pattern as a 16-character lowercase hex string in the canonical
-JSON: `{"kind":"float","bits":"<16-hex>"}`. Routing through the
+JSON: `{"kind":"float","bits":"<16-hex>"}` (see
+[Data model](data-model.md) for the literal schema). Routing through the
 JSON *string* path (not `serde_json::Number`) preserves bit
 stability across `serde_json` versions and lets NaN / ±Inf
 round-trip through Form-A — JSON numbers cannot represent them.
+This bits-hex encoding is what keeps Floats inside the
+[Roundtrip Invariant](roundtrip-invariant.md).
 
-**Pattern matching:** `Pattern::Lit` on `Literal::Float` is hard-
+**Pattern matching:** `Pattern::Lit` on `Literal::Float` (see
+[Data model](data-model.md) for the pattern schema) is hard-
 rejected at typecheck (`CheckError::FloatPatternNotAllowed`). IEEE
 semantics make Float patterns semantically dubious — NaN never
 matches via IEEE-`==`, and bit-exact equality is rarely what an