iter ext-cli.1: CLI accepts .ail (Form A) sources alongside .ail.json

Closes the loop opened by this morning's .ailx → .ail rename. Every
path-taking ail subcommand (check, build, run, manifest, render,
prose, merge-prose, describe, emit-ir, diff, workspace, deps) now
accepts a .ail (Form A) input as well as .ail.json (Form B). For
.ail paths the subcommand parses through ailang_surface::parse
in-line and proceeds with the same loaded Module value .ail.json
would have produced; binary semantics are extension-agnostic.

Architecture: a new ailang_surface::{load_module, load_workspace}
pair dispatches on file extension. A new injection point
ailang_core::workspace::load_workspace_with<F> lets the surface
crate plug in an extension-aware loader without core having to
import surface (which would close a crate cycle). Import resolution
in workspace::visit now prefers a .ail sibling over a .ail.json
sibling. The CLI binary's 18 callsites switched to the surface
loaders. Surface parse failures route through
workspace_error_to_diagnostic as a new SurfaceParse variant of
WorkspaceLoadError, so `ail check --json foo.ail` on a malformed
.ail returns a parseable JSON diagnostic with code
surface-parse-error instead of the misleading
`json: expected value at line 1 column 1` fall-through.

Boss pre-commit correction: the implementer followed the plan
verbatim and used snake_case `surface_parse_error`, but every
existing diagnostic code in the codebase is kebab-case (verified
via `git grep` over crates/ailang-check/src and crates/ail/src);
realigned to `surface-parse-error` at three sites (the diagnostic
arm + two ct1 test strings). Journal Concerns section records
the correction.

Tests: cargo test --workspace 487 green (+7 from this iter:
1 core unit, 4 surface integration, 1 ail E2E pair, 1 ct1 CLI
diagnostic-shape). bench/check.py, compile_check.py, cross_lang.py
clean on re-run; the latency.{explicit,implicit}_at_rc tail
cluster occasionally flagged on first runs is the same
nondeterministic cluster the previous two audits documented;
baseline left pristine for the third consecutive iter.

Roadmap follow-up "ail check/build/run accept .ail extension" (P2)
removed.

DESIGN.md §Decision 6 / "CLI" bullet gained the symmetric upward
sentence: both .ail and .ail.json are first-class CLI inputs.

crates/ail/tests/ct1_check_cli.rs

@@ -178,3 +178,47 @@ fn check_ordering_match_post_migration_is_clean() {
         "expected zero diagnostics on migrated fixture; got {stdout}"
     );
 }
+
+/// Property: `ail check --json` on a `.ail` (Form A) source file with
+/// a syntax error returns a structured `surface-parse-error`
+/// diagnostic (non-empty diagnostics array, exit code != 0), rather
+/// than crashing with the misleading JSON-parse fall-through that
+/// ext-cli.1 was built to eliminate. Guards against
+/// `workspace_error_to_diagnostic` losing the `SurfaceParse` arm or
+/// the surface dispatcher silently swallowing the parse error.
+#[test]
+fn ail_check_json_on_ail_with_syntax_error_returns_structured_diagnostic() {
+    let tmp = tempfile::tempdir().expect("tempdir");
+    let bad = tmp.path().join("bad.ail");
+    // Deliberately broken — missing closing paren in the module header.
+    std::fs::write(&bad, "(module bad\n").expect("write");
+
+    let output = Command::new(ail_bin())
+        .args(["check", "--json", bad.to_str().unwrap()])
+        .output()
+        .expect("run ail check --json");
+
+    // ail check --json on a bad .ail should NOT crash with the misleading
+    // JSON-parse fall-through; it should return exit code != 0 and emit a
+    // parseable JSON diagnostic on stdout.
+    assert!(
+        !output.status.success(),
+        "expected non-zero exit on bad source; stdout={} stderr={}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr),
+    );
+
+    let stdout = String::from_utf8(output.stdout).expect("stdout is UTF-8");
+    let parsed: serde_json::Value = serde_json::from_str(&stdout)
+        .unwrap_or_else(|e| panic!("stdout not valid JSON: {e}\ngot:\n{stdout}"));
+
+    let diags = parsed.as_array().expect("diagnostics array");
+    assert!(!diags.is_empty(), "at least one diagnostic emitted");
+    let first = &diags[0];
+    assert_eq!(first["code"].as_str(), Some("surface-parse-error"));
+    // The offending path goes into the ctx payload (matching the
+    // shape every other workspace-error diagnostic uses, e.g.
+    // `schema-mismatch` puts `expected`/`actual` there).
+    assert!(first["ctx"]["path"].is_string(), "ctx.path is the file path");
+    assert!(first["message"].is_string(), "message is the formatted ParseError");
+}