iter eob.1: effect-op args walk as Borrow; heap-Str RC discipline closes

Language rule: Term::Do.args[*] are walked in Position::Borrow by
the uniqueness + linearity passes, symmetric to Term::Ctor.args[*]
being walked in Position::Consume. The kind itself carries the
ownership default — no per-op field on EffectOpSig. Three
analyser sites flip in lockstep: uniqueness.rs:289, linearity.rs:506,
and the shared doc-comment at linearity.rs:42.

Heap-Str-specific consequences (closing hs.4's leak):
- int_to_str / float_to_str ret_mode: Implicit → Own at four lockstep
  sites (builtins.rs:200,210 + synth.rs:172,179). The codegen
  trackability gate (drop.rs:464-475, iter 18g.2) now fires on these
  callees, so the let-binder receives a scope-close drop.
- drop_symbol_for_binder's App arm gets a Type::Con{name:"Str"} →
  "ailang_rc_dec" carve-out, symmetric to field_drop_call's existing
  Str arm. Without it, the new Own-trackable App binder would emit
  drop_<m>_Str (undefined).

Tests: the two pre-existing RED tests at e2e.rs (commit 592d87b)
flip to GREEN unchanged with predicted numbers (allocs=1,frees=1,
live=0 and allocs=2,frees=2,live=0). Two new positive tests pin
the rule's coverage: primitive-Int arg through io/print_int produces
zero RC traffic; heap-Str through 2× io/print_str in sequence
typechecks (no use-after-consume) and balances allocs=1,frees=1,
live=0.

DESIGN.md §Decision 10 gets the arg-position-policy table for both
AST node kinds (Ctor=Consume, Do=Borrow) plus a linking paragraph
explaining how Do=Borrow cooperates with ret_mode==Own.

heap-str-abi milestone closes here: WhatsNew entry shipped (Strings
produced at runtime now release cleanly), roadmap P1 entry checked
off, Post-22-Prelude depends-on line removed.

Workspace cargo test + cross_lang.py + compile_check.py all green.
check.py noisy latency cluster + bench_list_sum.bump_s ±12% — same
precedent as the previous two audits, not coupled to this milestone.

crates/ailang-codegen/src/drop.rs

@@ -534,6 +534,14 @@ impl<'a> Emitter<'a> {
             Term::App { .. } => {
                 if let Ok(ret_ty) = self.synth_arg_type(value) {
                     if let Type::Con { name, .. } = ret_ty {
+                        // Symmetric to `field_drop_call`'s Str arm: Str is a
+                        // built-in pointer type with no per-type drop fn. Both
+                        // heap-Str (rc_header at payload-8) and static-Str
+                        // (codegen-elision keeps static pointers out of this
+                        // path) consume via `ailang_rc_dec`.
+                        if name == "Str" {
+                            return "ailang_rc_dec".to_string();
+                        }
                         if name.matches('.').count() == 1 {
                             let (prefix, suffix) =
                                 name.split_once('.').expect("checked");

crates/ailang-codegen/src/synth.rs

@@ -169,14 +169,14 @@ pub(crate) fn builtin_ail_type(name: &str) -> Option<Type> {
             ret: Box::new(Type::str_()),
             effects: vec![],
             param_modes: vec![],
-            ret_mode: ParamMode::Implicit,
+            ret_mode: ParamMode::Own,
         },
         "int_to_str" => Type::Fn {
             params: vec![Type::int()],
             ret: Box::new(Type::str_()),
             effects: vec![],
             param_modes: vec![],
-            ret_mode: ParamMode::Implicit,
+            ret_mode: ParamMode::Own,
         },
         "is_nan" => Type::Fn {
             params: vec![Type::float()],