iter form-a.1 (Tasks 1-5): additive phase + relocation

First half of the form-a-default-authoring milestone-close iter
(Boss-decided strategy C, big-bang). All five tasks DONE; cargo
test --workspace green at every per-task boundary.

T1 — Add three new tests:
- parse_is_deterministic_over_every_ail_fixture (round_trip.rs)
- cli_parse_then_render_then_parse_is_idempotent (roundtrip_cli.rs)
- carve_out_inventory.rs (new file; #[ignore]'d until T8 deletion)

T2 — Bulk-render the 99 missing examples/<stem>.ail files via
`ail render`. Corpus 58 .ail (pre-iter) -> 157 .ail. Eight .ail.json
carve-outs (7 §C4(a) subject-matter + 1 §C4(b) prelude) preserved.
One re-loop triggered: load_workspace prefers .ail siblings since
ext-cli.1, so the newly-rendered imports broke seven Group-A entries
whose JSON entry-paths now resolved imports to fresh .ail. Repair:
pre-emptive forward-pull of five T3 migrations + 4 transient
#[ignore]s on workspace.rs mod tests (cleanly relocated in T5).

T3 — 14 Group-A test files migrated from ailang_core::load_workspace
to ailang_surface::load_workspace + .ail paths. Carve-out lines
preserved verbatim (7 sites in typeclass_22b2.rs / typeclass_22b3.rs).

T4 — 12 Group-B test files: bulk regex flip on build_and_run /
build_and_run_with_alloc / build_and_run_with_rc_stats call sites
(~70 e2e.rs invocations + 11 subprocess sites). Four files
mis-classified Group-A as Group-B in plan recon (mono_hash_stability,
prelude_free_fns, print_mono_body_shape, show_mono_synthesis); two
files mis-classified Group-B as Group-A (mono_recursive_fn,
mono_xmod_qualified_ref). Migrated per actual shape, not plan label.

T5 — Relocated #[cfg(test)] mod tests from production source to
integration test crates with ailang-surface dev-dependency:
- crates/ailang-core/tests/hash_pin.rs (10 tests from hash.rs)
- crates/ailang-core/tests/workspace_pin.rs (10 non-carve-out tests
  from workspace.rs)
- crates/ailang-codegen/tests/eq_primitives_pin.rs (3 tests from
  codegen/src/lib.rs:3717-3799)
- ailang-prose/tests/snapshot.rs migrated (helper + 8 fixtures) to
  .ail + ailang_surface::load_module
Carve-out tests in workspace.rs mod tests preserved in-place
(3× 22b2 + 3× ct1 = 6 tests). Tempdir-based loader-mechanism tests
(3 sites) also preserved — they don't consume examples/.

Tests: 560 passed, 0 failed, 4 ignored (was 558 + 3 T1 new -
1 transit carve_out_inventory #[ignore] = 560 active).

Tasks 6-12 (bench-driver suffix flips, e2e diff-test rewrite + 4
additional raw-JSON-inspect handlers, .ail.json deletion, retiring
obsolete roundtrip tests + schema_coverage corpus flip, §C3
DESIGN.md restatement, §A4 doctrine edits, WhatsNew + roadmap
strike) ship in the next dispatch on this iter ID.

Known debt inherited to T6-12: 4 raw-JSON-inspect tests in e2e.rs
(borrow_own_demo / reuse_as_demo / render_parse_round_trip_canonical
/ ail_run_accepts_ail_source_with_same_stdout_as_ail_json dual-form
smoke) need rewrite or #[ignore] before T8 deletion; recorded in
journal Concerns + Known debt sections.

crates/ail/tests/roundtrip_cli.rs

@@ -45,6 +45,23 @@ fn list_json_fixtures() -> Vec<PathBuf> {
     paths
 }
 
+fn list_ail_fixtures() -> Vec<PathBuf> {
+    let dir = examples_dir();
+    let mut paths: Vec<PathBuf> = std::fs::read_dir(&dir)
+        .unwrap_or_else(|e| panic!("read_dir({}): {e}", dir.display()))
+        .filter_map(|entry| entry.ok())
+        .map(|e| e.path())
+        .filter(|p| {
+            p.file_name()
+                .and_then(|n| n.to_str())
+                .map(|n| n.ends_with(".ail"))
+                .unwrap_or(false)
+        })
+        .collect();
+    paths.sort();
+    paths
+}
+
 fn strip_trailing_newlines(mut v: Vec<u8>) -> Vec<u8> {
     while v.last() == Some(&b'\n') {
         v.pop();
@@ -144,3 +161,110 @@ fn cli_render_then_parse_preserves_canonical_bytes_on_every_fixture() {
     }
     eprintln!("CLI roundtrip ok for {passed} fixtures");
 }
+
+/// CLI-pipeline idempotency (post-form-a-default-authoring §C3): for
+/// every `.ail` fixture, the user-facing pipeline
+/// `ail parse <ail> | ail render | ail parse` is byte-identical
+/// to direct `ail parse <ail>`. Pins drift internal tests cannot see.
+#[test]
+fn cli_parse_then_render_then_parse_is_idempotent() {
+    let fixtures = list_ail_fixtures();
+    assert!(
+        !fixtures.is_empty(),
+        "no .ail fixtures found under {}",
+        examples_dir().display()
+    );
+
+    let tmpdir = tempfile::TempDir::new().expect("create tempdir");
+    let mut checked = 0usize;
+    let mut failures = Vec::<String>::new();
+
+    for ail_path in &fixtures {
+        // Direct parse → JSON tempfile.
+        let json1 = tmpdir.path().join(format!("v1_{checked}.ail.json"));
+        let parse1 = Command::new(ail_bin())
+            .args([
+                "parse",
+                ail_path.to_str().unwrap(),
+                "-o",
+                json1.to_str().unwrap(),
+            ])
+            .output()
+            .expect("spawn ail parse #1");
+        if !parse1.status.success() {
+            failures.push(format!(
+                "{}: first ail parse exit={:?}\nstderr: {}",
+                ail_path.display(),
+                parse1.status.code(),
+                String::from_utf8_lossy(&parse1.stderr),
+            ));
+            checked += 1;
+            continue;
+        }
+
+        // Render that JSON → .ail tempfile.
+        let ail_round = tmpdir.path().join(format!("round_{checked}.ail"));
+        let rendered = Command::new(ail_bin())
+            .args(["render", json1.to_str().unwrap()])
+            .output()
+            .expect("spawn ail render");
+        if !rendered.status.success() {
+            failures.push(format!(
+                "{}: ail render exit={:?}\nstderr: {}",
+                ail_path.display(),
+                rendered.status.code(),
+                String::from_utf8_lossy(&rendered.stderr),
+            ));
+            checked += 1;
+            continue;
+        }
+        std::fs::write(&ail_round, &rendered.stdout)
+            .expect("write ail_round tempfile");
+
+        // Re-parse → second JSON tempfile.
+        let json2 = tmpdir.path().join(format!("v2_{checked}.ail.json"));
+        let parse2 = Command::new(ail_bin())
+            .args([
+                "parse",
+                ail_round.to_str().unwrap(),
+                "-o",
+                json2.to_str().unwrap(),
+            ])
+            .output()
+            .expect("spawn ail parse #2");
+        if !parse2.status.success() {
+            failures.push(format!(
+                "{}: second ail parse exit={:?}\nstderr: {}",
+                ail_path.display(),
+                parse2.status.code(),
+                String::from_utf8_lossy(&parse2.stderr),
+            ));
+            checked += 1;
+            continue;
+        }
+
+        // Assert the two canonical JSONs are byte-equal.
+        let b1 = std::fs::read(&json1).expect("read json1");
+        let b2 = std::fs::read(&json2).expect("read json2");
+        if b1 != b2 {
+            let s1 = String::from_utf8_lossy(&b1).into_owned();
+            let s2 = String::from_utf8_lossy(&b2).into_owned();
+            failures.push(format!(
+                "{}: CLI parse|render|parse non-idempotent.\n  v1: {s1}\n  v2: {s2}",
+                ail_path.display(),
+            ));
+        }
+        checked += 1;
+    }
+
+    if !failures.is_empty() {
+        panic!(
+            "CLI parse|render|parse non-idempotent on {} of {} fixtures:\n{}",
+            failures.len(),
+            checked,
+            failures.join("\n\n")
+        );
+    }
+    assert!(checked > 0, "no .ail fixtures found");
+    eprintln!("CLI parse|render|parse idempotent for {checked} fixtures");
+}