Iter 14c: ailang-surface ships — form (A) parser + pretty-printer

Strictly additive new crate per Decision 6 architectural pin.
JSON-AST stays the source of truth; ailang-surface is one
producer/consumer of ailang_core::ast::Module values. ailang-check
and ailang-codegen unchanged.

Crate contents:
- src/lex.rs (~264 LOC): 3-rule lexical core. Whitespace and parens
  delimit tokens; semicolon to EOL is comment; first-character
  classifier (digit -> int, " -> string, else -> ident).
- src/parse.rs (~1041 LOC): hand-written recursive descent. One Rust
  fn per EBNF production. No parser-combinator dep.
- src/print.rs (~371 LOC): deterministic pretty-printer. Round-trip
  contract with parse() is the surface's correctness gate.
- tests/round_trip.rs (~128 LOC): integration test runs every
  examples/*.ail.json fixture through print -> parse -> canonical
  JSON, asserts canonical-byte equality with the original.

Two AST-driven form widenings beyond the 14b sketch (both folded
into DESIGN.md Decision 6):
- lam-term carries (typed name type) params, ret type, and
  optional effects (Term::Lam has parallel param_tys/ret_ty/
  effects fields).
- import-clause admits (import name (as alias)?) (Import.alias
  is Option<String>).

Production count ~28, under 30-rule budget. Constraint 1
(formalisable for foreign LLM) intact.

Verification:
- cargo build --workspace green.
- cargo test --workspace: 76 tests green (was 64; +9 surface unit,
  +2 round-trip integration). All 17 fixtures round-trip
  byte-identical at canonical level. 3 hand-written .ailx
  exhibits parse to canonical JSON identical to their .ail.json
  siblings.
- cargo doc --no-deps zero warnings (DESIGN.md item 6 invariant).

Manual smoke test (ail parse → ail run): hello, box,
list_map_poly all produce expected output through the form-(A)
authoring lane end-to-end.

CLI: ail parse <file.ailx> [-o <file.ail.json>]. .ail.json
remains a first-class input to every existing subcommand.

Plan 14d: stdlib (std_list.ailx with length/filter/fold/concat/
reverse/head/tail), authored in form (A) from day one.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/ailang-surface/tests/round_trip.rs

@@ -0,0 +1,128 @@
+//! Round-trip gate for the form-(A) projection.
+//!
+//! For every `examples/*.ail.json` fixture, this test:
+//!
+//! 1. Loads the original module via `ailang_core::load_module`.
+//! 2. Prints it with `ailang_surface::print`.
+//! 3. Re-parses the printed text with `ailang_surface::parse`.
+//! 4. Canonicalises both modules and asserts byte-equal canonical JSON.
+//!
+//! In addition, the three hand-written exhibits (`hello.ailx`,
+//! `box.ailx`, `list_map_poly.ailx`) are parsed and asserted to produce
+//! canonical JSON identical to their corresponding `.ail.json`
+//! fixtures. This is the human/AI authoring ground-truth check that
+//! the form is writeable without going through the printer.
+
+use std::path::{Path, PathBuf};
+
+fn examples_dir() -> PathBuf {
+    // `CARGO_MANIFEST_DIR` is the surface crate root; examples live two
+    // levels up.
+    let crate_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    crate_dir.parent().unwrap().parent().unwrap().join("examples")
+}
+
+fn list_json_fixtures() -> Vec<PathBuf> {
+    let dir = examples_dir();
+    let mut paths: Vec<PathBuf> = std::fs::read_dir(&dir)
+        .unwrap_or_else(|e| panic!("read_dir({}): {e}", dir.display()))
+        .filter_map(|entry| entry.ok())
+        .map(|e| e.path())
+        .filter(|p| {
+            p.file_name()
+                .and_then(|n| n.to_str())
+                .map(|n| n.ends_with(".ail.json"))
+                .unwrap_or(false)
+        })
+        .collect();
+    paths.sort();
+    paths
+}
+
+#[test]
+fn print_then_parse_round_trips_every_fixture() {
+    let fixtures = list_json_fixtures();
+    assert!(
+        !fixtures.is_empty(),
+        "no .ail.json fixtures found under {}",
+        examples_dir().display()
+    );
+
+    let mut failures = Vec::<String>::new();
+    let mut passed = 0usize;
+    for path in &fixtures {
+        match round_trip_one(path) {
+            Ok(()) => passed += 1,
+            Err(msg) => failures.push(format!("{}: {msg}", path.display())),
+        }
+    }
+    if !failures.is_empty() {
+        panic!(
+            "round-trip failed for {} of {} fixtures (passed: {}):\n{}",
+            failures.len(),
+            fixtures.len(),
+            passed,
+            failures.join("\n")
+        );
+    }
+    eprintln!("round-trip ok for {passed} fixtures");
+}
+
+fn round_trip_one(path: &Path) -> Result<(), String> {
+    let original = ailang_core::load_module(path).map_err(|e| format!("load: {e}"))?;
+    let text = ailang_surface::print(&original);
+    let parsed = ailang_surface::parse(&text)
+        .map_err(|e| format!("re-parse failed: {e}\n--- printed text ---\n{text}"))?;
+    let bytes_orig = ailang_core::canonical::to_bytes(&original);
+    let bytes_round = ailang_core::canonical::to_bytes(&parsed);
+    if bytes_orig != bytes_round {
+        let s_orig = String::from_utf8_lossy(&bytes_orig).into_owned();
+        let s_round = String::from_utf8_lossy(&bytes_round).into_owned();
+        return Err(format!(
+            "canonical bytes differ.\noriginal: {s_orig}\nround:    {s_round}"
+        ));
+    }
+    Ok(())
+}
+
+#[test]
+fn handwritten_exhibits_match_json_fixtures() {
+    let dir = examples_dir();
+    let pairs: &[(&str, &str)] = &[
+        ("hello.ailx", "hello.ail.json"),
+        ("box.ailx", "box.ail.json"),
+        ("list_map_poly.ailx", "list_map_poly.ail.json"),
+    ];
+    let mut failures = Vec::new();
+    for (ailx, json) in pairs {
+        let ailx_path = dir.join(ailx);
+        let json_path = dir.join(json);
+        let text = std::fs::read_to_string(&ailx_path)
+            .unwrap_or_else(|e| panic!("read {}: {e}", ailx_path.display()));
+        let parsed = match ailang_surface::parse(&text) {
+            Ok(m) => m,
+            Err(e) => {
+                failures.push(format!("{ailx}: parse failed: {e}"));
+                continue;
+            }
+        };
+        let original = ailang_core::load_module(&json_path)
+            .unwrap_or_else(|e| panic!("load {}: {e}", json_path.display()));
+        let bytes_orig = ailang_core::canonical::to_bytes(&original);
+        let bytes_parsed = ailang_core::canonical::to_bytes(&parsed);
+        if bytes_orig != bytes_parsed {
+            let s_orig = String::from_utf8_lossy(&bytes_orig).into_owned();
+            let s_round = String::from_utf8_lossy(&bytes_parsed).into_owned();
+            failures.push(format!(
+                "{ailx} vs {json}: canonical bytes differ.\noriginal: {s_orig}\nparsed:   {s_round}"
+            ));
+        }
+    }
+    if !failures.is_empty() {
+        panic!(
+            "{} hand-written exhibit(s) failed:\n{}",
+            failures.len(),
+            failures.join("\n\n")
+        );
+    }
+}