iter ext-cli.1: CLI accepts .ail (Form A) sources alongside .ail.json

Closes the loop opened by this morning's .ailx → .ail rename. Every
path-taking ail subcommand (check, build, run, manifest, render,
prose, merge-prose, describe, emit-ir, diff, workspace, deps) now
accepts a .ail (Form A) input as well as .ail.json (Form B). For
.ail paths the subcommand parses through ailang_surface::parse
in-line and proceeds with the same loaded Module value .ail.json
would have produced; binary semantics are extension-agnostic.

Architecture: a new ailang_surface::{load_module, load_workspace}
pair dispatches on file extension. A new injection point
ailang_core::workspace::load_workspace_with<F> lets the surface
crate plug in an extension-aware loader without core having to
import surface (which would close a crate cycle). Import resolution
in workspace::visit now prefers a .ail sibling over a .ail.json
sibling. The CLI binary's 18 callsites switched to the surface
loaders. Surface parse failures route through
workspace_error_to_diagnostic as a new SurfaceParse variant of
WorkspaceLoadError, so `ail check --json foo.ail` on a malformed
.ail returns a parseable JSON diagnostic with code
surface-parse-error instead of the misleading
`json: expected value at line 1 column 1` fall-through.

Boss pre-commit correction: the implementer followed the plan
verbatim and used snake_case `surface_parse_error`, but every
existing diagnostic code in the codebase is kebab-case (verified
via `git grep` over crates/ailang-check/src and crates/ail/src);
realigned to `surface-parse-error` at three sites (the diagnostic
arm + two ct1 test strings). Journal Concerns section records
the correction.

Tests: cargo test --workspace 487 green (+7 from this iter:
1 core unit, 4 surface integration, 1 ail E2E pair, 1 ct1 CLI
diagnostic-shape). bench/check.py, compile_check.py, cross_lang.py
clean on re-run; the latency.{explicit,implicit}_at_rc tail
cluster occasionally flagged on first runs is the same
nondeterministic cluster the previous two audits documented;
baseline left pristine for the third consecutive iter.

Roadmap follow-up "ail check/build/run accept .ail extension" (P2)
removed.

DESIGN.md §Decision 6 / "CLI" bullet gained the symmetric upward
sentence: both .ail and .ail.json are first-class CLI inputs.

docs/roadmap.md

@@ -182,16 +182,6 @@ context. Pick the next milestone from P1.)_
   - context: fieldtest 2026-05-11 — fieldtest fixtures could not be
     placed under `examples/fieldtest/` because of this; predates the
     canonical-type-names milestone but surfaces every time.
-- [ ] **\[todo\]** `ail check`/`build`/`run` accept `.ail` extension —
-  today `ail check foo.ail` produces a misleading JSON-parse error
-  (`json: expected value at line 1 column 1`) because the loader only
-  accepts `.ail.json`. Either teach the CLI subcommands to auto-parse
-  `.ail` internally, or detect the extension and emit a
-  "did you mean `ail parse foo.ail`?" hint. The LLM-author's natural
-  first command should not be the one that produces a misleading
-  diagnostic.
-  - context: fieldtest 2026-05-11 — orthogonal to canonical-type-names
-    but every fieldtest invocation hits this on its first command.
 - [ ] **\[todo\]** `check_in_workspace` per-module overlay narrowing —
   `crates/ailang-check/src/lib.rs:1234` still clears+rebuilds
   `env.ctor_index` per-module; ct.3.2 narrowed the analogous mono