iter mut.1: AST extension + Form A surface for local mutable state

First iteration of the mut-local milestone (foundation step on the
Stateful-islands roadmap path). Lands the schema + surface tier:
Term::Mut, Term::Assign, and the nested MutVar struct become
first-class AST nodes that round-trip cleanly through Form A.
Typecheck and codegen recognition are deferred to mut.2 and mut.3
per the spec's out-of-iteration boundary; reaching either dispatch
entry point with these variants produces CheckError::Internal /
CodegenError::Internal with a 'deferred to iter mut.{2,3}' message.

Concretely:

- crates/ailang-core/src/ast.rs: two new Term variants behind
  #[serde(tag = 't')]; pub struct MutVar { name, ty, init } adjacent
  to Arm. Two canonical-bytes pin tests for the explicit-empty-vars
  serialisation and the assign round-trip.

- ~25 substantive Term-walker arms across ailang-core/desugar,
  ailang-core/workspace, ailang-check (lib + lift + linearity + mono
  + pre_desugar_validation + reuse_shape + uniqueness),
  ailang-codegen (escape + lambda + lib), ailang-prose, and
  crates/ail/src/main.rs. Universal policy: substantive recurse-into-
  children at every site; only the two dispatch entry points
  (synth in ailang-check, lower_term in ailang-codegen) stub with
  Internal-error. One test-side walker arm in
  crates/ail/tests/codegen_import_map_fallback_pin.rs not
  enumerated by the plan was added as well (defensive recursion).

- ailang-surface: parse_mut + parse_assign helpers; Term::Mut
  body desugared from a flat statement sequence into a right-folded
  Term::Seq chain inside the JSON-AST. Print arms in print.rs match
  the parser convention. EBNF prologue + crates/ailang-core/specs/
  form_a.md productions updated. Four new parser pin tests cover
  the empty-mut, single-var, body-required, and vars-only-no-body
  cases.

- Drift + coverage tests extended: design_schema_drift.rs adds two
  exemplars + match arms; schema_coverage.rs adds two VariantTag
  entries + EXPECTED_VARIANTS + visit_term arms; spec_drift.rs adds
  two exemplars + match arms. DESIGN.md §'Term (expression)' gets
  jsonc-blocked schemas for the two new variants.

- examples/mut.ail: six-fn round-trip fixture exercising empty mut,
  single-var, two-var, nested-shadow, and the four supported scalar
  return types (Int, Float, Bool, Unit). The round_trip auto-glob
  and schema_coverage corpus walker both pick it up.

Plan deviation: the plan named lib.rs:2572 as the typecheck
dispatch stub site, but that line is actually verify_tail_positions
(substantive walker). The real dispatch is synth (3403-area, stub
at 3489); the orchestrator routed correctly.

Tests: 564 → 579 green; cargo build green; round-trip green for
the new fixture; all drift + coverage tests green.

Journal: docs/journals/2026-05-15-iter-mut.1.md.

Refs: docs/specs/2026-05-15-mut-local.md, docs/plans/2026-05-15-iter-mut.1.md.

crates/ailang-codegen/src/lambda.rs

@@ -430,6 +430,43 @@ impl<'a> Emitter<'a> {
                 Self::collect_captures(source, bound, captures, captures_set, builtins, top_level);
                 Self::collect_captures(body, bound, captures, captures_set, builtins, top_level);
             }
+            // Iter mut.1: a mut-var name binds inside the block. Var
+            // inits before the binding see the outer scope; later
+            // inits and the body see the var as bound. Mut-vars
+            // cannot be captured by an inner lambda in mut.1 (the
+            // typecheck pass at mut.2 will enforce this); for the
+            // capture-collection scan the var bindings are tracked
+            // identically to let-bound names.
+            Term::Mut { vars, body } => {
+                let mut newly_bound: Vec<String> = Vec::new();
+                for v in vars {
+                    Self::collect_captures(&v.init, bound, captures, captures_set, builtins, top_level);
+                    if bound.insert(v.name.clone()) {
+                        newly_bound.push(v.name.clone());
+                    }
+                }
+                Self::collect_captures(body, bound, captures, captures_set, builtins, top_level);
+                for n in newly_bound {
+                    bound.remove(&n);
+                }
+            }
+            Term::Assign { name, value, .. } => {
+                // The assigned `name` is a use of a mut-var binding.
+                // If it is bound in scope (it should be, by spec), it
+                // is not a capture. Otherwise — well-formed inputs do
+                // not produce this case (the typecheck pass at mut.2
+                // rejects it via `MutAssignOutOfScope`); we
+                // conservatively treat it as a possible capture so an
+                // ill-formed input still flows through codegen.
+                if !bound.contains(name)
+                    && !builtins.contains(name.as_str())
+                    && !top_level.contains(name)
+                    && captures_set.insert(name.clone())
+                {
+                    captures.push(name.clone());
+                }
+                Self::collect_captures(value, bound, captures, captures_set, builtins, top_level);
+            }
         }
     }