iter embedding-abi-m3.tidy (DONE 3/3): close M3 audit [medium]+[low] doc-honesty drift, pin-safe

[medium] DESIGN.md §"Embedding ABI": surgically replaced ONLY the
contradicted M1-era parenthetical (asserted the export boundary is
scalar-only — false post-M3, a single-ctor record is an accepted
export type) with the present-tense truth pointing at the frozen-layout
SSOT + the own/borrow mode contract. The parenthetical shared physical
line :2300 with the docs_honesty_pin:135 pinned bare-scalar sentence;
the edit kept every pinned word (planner Step-5 item-6 pin-safety, the
M2.tidy precedent — docs_honesty_pin stayed 5/5 green, RED-restore path
never triggered). [low] codegen forwarder-body comment honesty fix
(comment-only; the IR byte-pins assert generated code not comments —
byte-identical before/after).

Boss-verified: both stale fragments grep-absent; 4 standing pins green
at the recon baseline; workspace 639/77 byte-unchanged; diff exactly
2 files. No behaviour change; the pins are the coverage (M2.tidy
precedent, no audit/fieldtest gate). bench already carry-on/NO-ratify
at the M3 audit (causally exonerated). One non-gating planner-quality
grep defect recorded in the journal Concerns (orchestrator handled it
correctly, no code bent).

docs/DESIGN.md

@@ -2297,8 +2297,9 @@ layout is **frozen as of M3** (see "Frozen value layout" below); the
 ctx-threaded C signature is the M2 shape.
 
 Export parameters are written **bare**: a scalar type carries no
-`own`/`borrow` mode (modes apply only to heap-shaped types, which the
-scalar-only rule above forbids at an export boundary anyway). The
+`own`/`borrow` mode (a single-constructor record export parameter,
+by contrast, carries `own`/`borrow` — the ownership contract the
+frozen value layout below specifies). The
 canonical M1 export shape:
 
 ```