docs(contracts): reconcile contracts + honesty-pin with shipped reality

First tranche of a contracts-against-code audit (the inverse of the
usual direction: testing the ledger's claims against the code). Each
fix here is a verified factual divergence between a contract and the
code; the direction of the fix follows which side actually drifted.

Code drifted from the stated goal -> fix the code:

- 0014's claim 6 ("`cargo doc --no-deps` runs warning-free") was the
  design goal; reality had 6 warnings. Demote the offending intra-doc
  links to plain code spans so the docs match the goal:
  - ailang-core: `[`load_workspace`]` cannot resolve from core (the
    fn lives in ailang-surface, which core may not depend on) — three
    sites in workspace.rs.
  - ailang-check: three public-item docs linked the `pub(crate)`
    helpers `qualify_local_types` / `qualify_workspace_types`.
  `cargo doc --no-deps --workspace` is now warning-free.

Contract stale, code legitimately advanced -> fix the contract:

- 0011 stated `float_to_str` "codegen is reserved and not yet
  shipped". It is shipped: lowers to `@ailang_float_to_str(double)`,
  green under the codegen `float_to_str_no_longer_errors_internal`
  unit test and the e2e `float_to_str_smoke`. The docs_honesty_pin
  anchor that protected the stale "reserved" wording moved in lockstep
  to assert the present-tense lowering instead — the pin had been
  guarding a claim the code already falsified.
- 0013 named the diagnostic `ConstraintReferencesUnboundTypeVar`; the
  variant is `UnboundConstraintTypeVar` (workspace.rs), and its scope
  is a class-method signature whose constraint mentions a tyvar bound
  neither by the method's `forall` nor by the class `param`.
- 0017 called the primitive Eq/Ord bodies "placeholder lambdas"; they
  carry the `(intrinsic)` marker — the lockstep partner to the
  INTERCEPTS registry, not a placeholder.
- 0009 said "seven" `.ail.json` carve-outs and described the inventory
  test as pinning seven; the test pins twelve (7 subject-matter + 4
  recur + 1 loop-binder, per carve_out_inventory.rs).

Verified separately: 0001's "pretty-printer code in pretty.rs was
deleted, leaving only diagnostic helpers" is factually correct (an
audit agent misread it as "pretty.rs was deleted"); its only issue is
history phrasing, deferred to the honesty-prose tranche.

Deferred to later tranches: honesty-rule prose (history/rationale that
is not a protected honest-reserved/tiebreaker anchor), stale/mislinked
ratifying-tests (0014's `architect_sweeps.sh`, 0015's uniqueness
in-source tests), 0014's never-existent `tests/expected/`, 0012's
non-exhaustive tail-context list, and the 0016<->0013 redundancy.

crates/ailang-check/src/lib.rs

@@ -1131,7 +1131,7 @@ pub fn check_module(m: &Module) -> Vec<Diagnostic> {
 /// 2. Normalize every consumer module's bare cross-module `Type::Con`
 ///    references to qualified `<home>.<Type>` form (so consumer-side
 ///    declared types unify with imported-fn signatures, which the
-///    existing [`qualify_local_types`] step already qualifies at the
+///    existing `qualify_local_types` step already qualifies at the
 ///    owner's side).
 ///
 /// Both [`check_workspace`] and [`monomorphise_workspace`] call this
@@ -4844,11 +4844,11 @@ pub(crate) fn qualify_workspace_types(
 
 /// prep.1: walk a [`Module`] and rewrite every `Type` annotation
 /// (function signatures, const types, `Term::Lam.param_tys`/`ret_ty`,
-/// `Term::LetRec.ty`) by applying [`qualify_workspace_types`]. Bare
+/// `Term::LetRec.ty`) by applying `qualify_workspace_types`. Bare
 /// cross-module `Type::Con` names are upgraded to qualified
 /// `<home>.<Type>` form so that consumer-side declared types unify
 /// against imported-fn signatures (which the existing
-/// [`qualify_local_types`] step already qualifies on the owner side).
+/// `qualify_local_types` step already qualifies on the owner side).
 pub fn qualify_workspace_module(
     mut m: Module,
     own_local_types: &IndexMap<String, TypeDef>,