iter form-a.1 (Tasks 1-5): additive phase + relocation

First half of the form-a-default-authoring milestone-close iter
(Boss-decided strategy C, big-bang). All five tasks DONE; cargo
test --workspace green at every per-task boundary.

T1 — Add three new tests:
- parse_is_deterministic_over_every_ail_fixture (round_trip.rs)
- cli_parse_then_render_then_parse_is_idempotent (roundtrip_cli.rs)
- carve_out_inventory.rs (new file; #[ignore]'d until T8 deletion)

T2 — Bulk-render the 99 missing examples/<stem>.ail files via
`ail render`. Corpus 58 .ail (pre-iter) -> 157 .ail. Eight .ail.json
carve-outs (7 §C4(a) subject-matter + 1 §C4(b) prelude) preserved.
One re-loop triggered: load_workspace prefers .ail siblings since
ext-cli.1, so the newly-rendered imports broke seven Group-A entries
whose JSON entry-paths now resolved imports to fresh .ail. Repair:
pre-emptive forward-pull of five T3 migrations + 4 transient
#[ignore]s on workspace.rs mod tests (cleanly relocated in T5).

T3 — 14 Group-A test files migrated from ailang_core::load_workspace
to ailang_surface::load_workspace + .ail paths. Carve-out lines
preserved verbatim (7 sites in typeclass_22b2.rs / typeclass_22b3.rs).

T4 — 12 Group-B test files: bulk regex flip on build_and_run /
build_and_run_with_alloc / build_and_run_with_rc_stats call sites
(~70 e2e.rs invocations + 11 subprocess sites). Four files
mis-classified Group-A as Group-B in plan recon (mono_hash_stability,
prelude_free_fns, print_mono_body_shape, show_mono_synthesis); two
files mis-classified Group-B as Group-A (mono_recursive_fn,
mono_xmod_qualified_ref). Migrated per actual shape, not plan label.

T5 — Relocated #[cfg(test)] mod tests from production source to
integration test crates with ailang-surface dev-dependency:
- crates/ailang-core/tests/hash_pin.rs (10 tests from hash.rs)
- crates/ailang-core/tests/workspace_pin.rs (10 non-carve-out tests
  from workspace.rs)
- crates/ailang-codegen/tests/eq_primitives_pin.rs (3 tests from
  codegen/src/lib.rs:3717-3799)
- ailang-prose/tests/snapshot.rs migrated (helper + 8 fixtures) to
  .ail + ailang_surface::load_module
Carve-out tests in workspace.rs mod tests preserved in-place
(3× 22b2 + 3× ct1 = 6 tests). Tempdir-based loader-mechanism tests
(3 sites) also preserved — they don't consume examples/.

Tests: 560 passed, 0 failed, 4 ignored (was 558 + 3 T1 new -
1 transit carve_out_inventory #[ignore] = 560 active).

Tasks 6-12 (bench-driver suffix flips, e2e diff-test rewrite + 4
additional raw-JSON-inspect handlers, .ail.json deletion, retiring
obsolete roundtrip tests + schema_coverage corpus flip, §C3
DESIGN.md restatement, §A4 doctrine edits, WhatsNew + roadmap
strike) ship in the next dispatch on this iter ID.

Known debt inherited to T6-12: 4 raw-JSON-inspect tests in e2e.rs
(borrow_own_demo / reuse_as_demo / render_parse_round_trip_canonical
/ ail_run_accepts_ail_source_with_same_stdout_as_ail_json dual-form
smoke) need rewrite or #[ignore] before T8 deletion; recorded in
journal Concerns + Known debt sections.

crates/ailang-check/tests/workspace.rs

@@ -5,7 +5,7 @@
 //! runs in JSON mode against a workspace.
 
 use ailang_check::{check_workspace, Severity};
-use ailang_core::load_workspace;
+use ailang_surface::load_workspace;
 use std::path::Path;
 
 /// Iter 18c.2: assert that the linearity check's `suggested_rewrites`
@@ -39,7 +39,7 @@ fn examples_dir() -> std::path::PathBuf {
 fn happy_path_resolves_qualified_import() {
     // ws_main imports ws_lib and calls `ws_lib.add` — fully typed.
     // Expected: no diagnostics.
-    let entry = examples_dir().join("ws_main.ail.json");
+    let entry = examples_dir().join("ws_main.ail");
     let ws = load_workspace(&entry).expect("load ws_main");
     let diags = check_workspace(&ws);
     assert!(
@@ -52,7 +52,7 @@ fn happy_path_resolves_qualified_import() {
 #[test]
 fn unknown_import_is_reported() {
     // ws_broken references `ws_lib.bogus` — module is there, def isn't.
-    let entry = examples_dir().join("ws_broken.ail.json");
+    let entry = examples_dir().join("ws_broken.ail");
     let ws = load_workspace(&entry).expect("load ws_broken");
     let diags = check_workspace(&ws);
     assert_eq!(diags.len(), 1, "got: {:?}", diags);
@@ -72,7 +72,7 @@ fn unknown_import_is_reported() {
 #[test]
 fn unknown_module_prefix_is_reported() {
     // ws_unknown_module has no imports but references `nope.x`.
-    let entry = examples_dir().join("ws_unknown_module.ail.json");
+    let entry = examples_dir().join("ws_unknown_module.ail");
     let ws = load_workspace(&entry).expect("load ws_unknown_module");
     let diags = check_workspace(&ws);
     assert_eq!(diags.len(), 1, "got: {:?}", diags);
@@ -674,7 +674,7 @@ fn reuse_as_shape_mismatch_is_reported_on_cons_to_nil() {
 /// are exactly the canonical accept shape.
 #[test]
 fn borrow_own_demo_is_linearity_clean() {
-    let entry = examples_dir().join("borrow_own_demo.ail.json");
+    let entry = examples_dir().join("borrow_own_demo.ail");
     let ws = load_workspace(&entry).expect("load borrow_own_demo");
     let diags = check_workspace(&ws);
     let lin: Vec<&ailang_check::Diagnostic> = diags