feat(lang): eliminate the Implicit ownership default — totality + the drop-soundness it demasks (#55)

Deletes `ParamMode::Implicit`. `ParamMode` is now `{Own, Borrow}`:
every fn-type slot on every signature carries an explicit `own` or
`borrow`, no defaulted position survives anywhere (model 0008 §2,
spec 0062). The parser rejects a bare fn-type slot; `borrow-return`
and `borrow-over-value` reject at the signature; the corpus is
migrated to minimal-ownership modes (consumed ⇒ own, read-only-heap
⇒ borrow, value ⇒ trivial-own). The documented `Implicit`-ret-mode
leak is fixed: an owned heap return now drops exactly once (live=0,
acceptance criterion 5).

This was the easy half. Removing the default ACTIVATED a family of
drop paths that `Implicit` had silently skipped — the pre-cutover
language was leaking (and in places mis-dropping) here rather than
crashing, because an Implicit scrutinee turned the drop off. Making
the modes explicit (Own) turned those paths on and exposed two
latent-bug clusters, all fixed RED-first as part of this cutover:

Drop-soundness family (four legs):
  A. lit-sub-pattern double-free — the desugar re-matched the same
     owned scrutinee in the lit fall-through; fixed by grouping
     consecutive same-ctor arms into one match (bind fields once),
     in ailang-core desugar.
  B. Cons-husk leak on non-tail arm bodies — the lit-sub-pattern
     desugar rebound the owned scrutinee via `Let $mp = xs`, which
     bumped consume_count and suppressed the existing fn-return
     partial_drop. Fixed by not rebinding a bare-Var scrutinee
     (one husk-freeing mechanism, not two).
  C. polymorphic `drop_<T>` rc_dec'd monomorphised value fields —
     the per-ADT drop fn was emitted once from the polymorphic
     TypeDef, defaulting type-var fields to ptr and rc_dec'ing
     inline Ints (segfault). Fixed with per-monomorph drop
     functions (new ailang-codegen::dropmono): the drop set is
     collected from the lowered MIR, value-type fields are skipped,
     heap fields still freed once; monomorphic-concrete ADTs keep
     their byte-identical un-suffixed drop symbol.
  D. static Str literal passed to an `(own Str)` param — the
     literal lowers to a header-less rodata constant; the callee's
     now-active rc_dec read its length field as a refcount and
     freed a static address (segfault). Fixed with the missing
     fourth StrRep::Static→Heap promotion in lower_to_mir's App arm,
     gated on Own mode (borrow args stay static, no regression).

over-strict-mode lint over-fired: it suggested `(borrow V)` for
value-typed params (which `borrow-over-value` rejects — own is the
only legal mode there) and fired on `(intrinsic)` bodies (whose
consumption the linearity walk cannot observe). Tightened to skip
both; contract 0008 updated to the narrowed firing scope.

Irreversible step — canonical-form hash reset (model 0008 §6,
acceptance criterion 6). Every signature now carries explicit modes,
so the hashable canonical JSON changed for every module. RATIFY:
the corpus-wide hash-pin reset (hash_pin, prelude_module_hash_pin,
mono_hash_stability, eq_ord_e2e, embed_export_hash_stable, the
ct4/iter*/loop_recur schema-extension pins) and the list ir_snapshot
golden were regenerated once, deliberately, as the intended one-time
consequence of removing the mode elision from the canonical form —
not a regression. Each regenerated hash verified deterministic across
two runs.

Also fixes a pre-existing latent failure surfaced by the verification
gate, unrelated to this cutover: the `every_contract_names_a_resolvable_
ratifying_test` resolver (design_index_pin) could not resolve the
" + " dual-link ratifying-test form (`uniqueness.rs + linearity.rs`)
that the #57 audit-close (dfdc65f) introduced — it shipped red on that
commit. Resolver taught the dual-link form, mirroring its sibling.

Verification: cargo test --workspace = 731 passed, 0 failed (twice,
stable); e2e 102 passed, no binary exits non-zero (corpus crash-free);
grep-clean for Implicit/fn_implicit/mode_eq across crates; every drop
fix confirmed via emitted IR + AILANG_RC_STATS balance on the head==K,
head!=K, and Nil paths. Three BLOCKEDs en route (the unsound first
husk-dec attempt, the over-strict derivation premise, the leg-B fix
direction) were each treated as a real design/spec gap and rediagnosed,
not patched over.

Supersedes #54 (return-position-only leak patch). Precondition #57
(linearity hardening) was already met. Spec docs/specs/0062, plan
docs/plans/0121.

closes #55

examples/bench_latency_implicit.ail

@@ -69,8 +69,8 @@
     (doc "Build a balanced tree of given depth, every value = 1. Constructor-blocked — recursion depth = `depth`, fits 8MB stack at depth 19.")
     (type
       (fn-type
-        (params (con Int))
-        (ret (con Tree))))
+        (params (own (con Int)))
+        (ret (own (con Tree)))))
     (params depth)
     (body
       (if (app eq depth 0)
@@ -84,8 +84,8 @@
     (doc "Touch every node of the tree (ensures liveness across the loop).")
     (type
       (fn-type
-        (params (con Tree))
-        (ret (con Int))))
+        (params (own (con Tree)))
+        (ret (own (con Int)))))
     (params t)
     (body
       (match t
@@ -99,8 +99,8 @@
     (doc "Tail-recursive list builder. Result = [n-1, n-2, ..., 0] :: IntList.")
     (type
       (fn-type
-        (params (con Int) (con IntList))
-        (ret (con IntList))))
+        (params (own (con Int)) (own (con IntList)))
+        (ret (own (con IntList)))))
     (params n acc)
     (body
       (if (app eq n 0)
@@ -113,8 +113,8 @@
     (doc "Build [0,1,...,n-1] :: IntList.")
     (type
       (fn-type
-        (params (con Int))
-        (ret (con IntList))))
+        (params (own (con Int)))
+        (ret (own (con IntList)))))
     (params n)
     (body
       (app cons_n_acc n (term-ctor IntList LNil))))
@@ -123,8 +123,8 @@
     (doc "Tail-recursive sum.")
     (type
       (fn-type
-        (params (con IntList) (con Int))
-        (ret (con Int))))
+        (params (own (con IntList)) (own (con Int)))
+        (ret (own (con Int)))))
     (params xs acc)
     (body
       (match xs
@@ -136,8 +136,8 @@
     (doc "Sum every element. Calls sum_list_acc with seed 0.")
     (type
       (fn-type
-        (params (con IntList))
-        (ret (con Int))))
+        (params (own (con IntList)))
+        (ret (own (con Int)))))
     (params xs)
     (body
       (app sum_list_acc xs 0)))
@@ -158,8 +158,8 @@
     (doc "Constant-time tree liveness pin — read root tag, return 1 (TNode) or 0 (TLeaf).")
     (type
       (fn-type
-        (params (con Tree))
-        (ret (con Int))))
+        (params (borrow (con Tree)))
+        (ret (own (con Int)))))
     (params t)
     (body
       (match t
@@ -170,8 +170,8 @@
     (doc "One bench operation: build+sum a fresh CHUNK_LEN-cell list, pin the tree's root, return their sum so the value chain stays observable.")
     (type
       (fn-type
-        (params (con Int) (con Tree))
-        (ret (con Int))))
+        (params (own (con Int)) (borrow (con Tree)))
+        (ret (own (con Int)))))
     (params chunk_len t)
     (body
       (app + (app sum_list (app cons_n chunk_len)) (app pin_root t))))
@@ -192,8 +192,8 @@
     (doc "Tail-recursive bench loop. Ops countdown in `remaining`; print marker every time `print_countdown` hits 0.")
     (type
       (fn-type
-        (params (con Int) (con Int) (con Int) (con Int) (con Tree))
-        (ret (con Unit))
+        (params (own (con Int)) (own (con Int)) (own (con Int)) (own (con Int)) (borrow (con Tree)))
+        (ret (own (con Unit)))
         (effects IO)))
     (params remaining print_countdown chunk_len print_k t)
     (body
@@ -218,7 +218,7 @@
 
   (fn main
     (doc "Top-level: build tree, signal READY (8888), run loop, signal DONE (9999 emitted by loop).")
-    (type (fn-type (params) (ret (con Unit)) (effects IO)))
+    (type (fn-type (params) (ret (own (con Unit))) (effects IO)))
     (params)
     (body
       (let t (app build_tree 19)