iter embedding-abi-m3.1 (DONE 6-7): freeze the value layout — DESIGN.md frozen-layout SSOT + lockstep pointers + enforceable byte-pin

Tasks 6-7 of the Boss-repaired split dispatch (Tasks 1-5 committed d5c565d).
Task 6: DESIGN.md §"Embedding ABI" gains the `### Frozen value layout
(M3 — one-way commitment)` SSOT subsection; both "provisional until M3"
sentences rewritten to one-way-freeze wording (docs_honesty_pin-safe — the
pinned "written **bare**" sentence stayed byte-verbatim, :2297->:2299
content-asserted); // FROZEN ABI lockstep pointers at runtime/rc.c +
match_lower.rs lower_ctor + drop.rs; 3 plan-named stale rustdocs fixed +
the Boss-caught stale // gate-comment block (check/lib.rs:1917-1922,
M1/scalar-only -> M1/M2/M3/C-ABI-permitted-incl-record); byte-pin
enforceability demonstrated (RED on a local offset perturbation, GREEN on
git-checkout restore — the only legitimate git op, working-tree only).
Task 7: milestone-close verification gate.

Boss-verified independently (agent report = intent, not outcome): workspace
639 passed / 0 failed; embed_record_e2e 2/2 (own+borrow, global
leak-freedom model); byte-pin 1/1; gate 10/10; forwarder 3/3;
docs_honesty_pin 5/5 pin-safe; design_schema_drift + embed_export_hash_stable
+ embed_e2e + M2 swarm regression-green-unmodified.

INDEX.md line added (deferred from the PARTIAL — one line per iter, final
title). Milestone-close audit next (architect Invariant 1 + bench trio,
spec Testing items 8/9 — audit-owned, not the implement run's job).

crates/ailang-core/src/ast.rs

@@ -208,7 +208,8 @@ pub struct FnDef {
     /// Iter embedding-abi-m1: when `Some(sym)`, this fn is the
     /// embedding boundary. Codegen's `Target::StaticLib` mode
     /// additionally emits an externally-visible C entrypoint
-    /// `@<sym>` (scalar signature, provisional until M3) forwarding
+    /// `@<sym>` (signature frozen as of M3 — DESIGN.md §"Embedding
+    /// ABI" > "Frozen value layout") forwarding
     /// to `@ail_<module>_<fn>`. The symbol is author-chosen and
     /// decoupled from the `ail_<module>_<def>` mangling so the
     /// M3-frozen ABI survives module/fn refactors.