iter embedding-abi-m3.tidy (DONE 3/3): close M3 audit [medium]+[low] doc-honesty drift, pin-safe

[medium] DESIGN.md §"Embedding ABI": surgically replaced ONLY the
contradicted M1-era parenthetical (asserted the export boundary is
scalar-only — false post-M3, a single-ctor record is an accepted
export type) with the present-tense truth pointing at the frozen-layout
SSOT + the own/borrow mode contract. The parenthetical shared physical
line :2300 with the docs_honesty_pin:135 pinned bare-scalar sentence;
the edit kept every pinned word (planner Step-5 item-6 pin-safety, the
M2.tidy precedent — docs_honesty_pin stayed 5/5 green, RED-restore path
never triggered). [low] codegen forwarder-body comment honesty fix
(comment-only; the IR byte-pins assert generated code not comments —
byte-identical before/after).

Boss-verified: both stale fragments grep-absent; 4 standing pins green
at the recon baseline; workspace 639/77 byte-unchanged; diff exactly
2 files. No behaviour change; the pins are the coverage (M2.tidy
precedent, no audit/fieldtest gate). bench already carry-on/NO-ratify
at the M3 audit (causally exonerated). One non-gating planner-quality
grep defect recorded in the journal Concerns (orchestrator handled it
correctly, no code bent).

crates/ailang-codegen/src/lib.rs

@@ -605,9 +605,10 @@ fn lower_workspace_inner(ws: &Workspace, alloc: AllocStrategy, target: Target) -
         Target::StaticLib => {
             // One external C entrypoint per `(export …)` fn,
             // forwarding to the internal `@ail_<module>_<fn>`.
-            // The check-side gate (Task 4) guarantees every param
-            // and the ret are `Int`/`Float`; map Int→i64,
-            // Float→double. M1 scalar fns have no captured env, so
+            // The check-side export gate guarantees every param and
+            // the ret are `Int`/`Float` or a single-constructor
+            // record of those (M3); map Int→i64, Float→double, a
+            // record → ptr. Scalar fns have no captured env, so
             // the internal callee takes the scalars positionally
             // (confirmed against `emit_fn`'s signature emission,
             // `lib.rs:1087`).