convention: counter-prefix file naming across docs/specs/, docs/plans/, design/contracts/, design/models/

All 176 files in the four accumulating directories now use a
zero-padded 4-digit counter prefix that reflects creation order
(`NNNN-slug.md`). The counter is assigned per directory in strict
git-log creation order; ties broken alphabetically by original name.
The old `YYYY-MM-DD-` prefix on docs/specs/ and docs/plans/ files is
dropped — the date is recoverable from git log and the counter
carries the ordering.

A file's counter is stable for the life of the file: never reassigned,
never reused, never compacted. Deleted files retire their counter;
subsequent files do not fill the gap. This is the property that lets
cross-references stay literal — refs use the full filename including
the counter (`design/contracts/0007-honesty-rule.md`) so they grep
cleanly and resolve directly without a glob step.

313 cross-references updated across .md/.rs/.toml/.c/.json files
(test pins, include_str! paths, design-INDEX entries, baseline notes,
runtime C comments, inter-contract markdown links incl. bare basename
and `../models/foo.md` forms).

CLAUDE.md gets a new "File-naming convention" section spelling out
the rule and rationale. skills/brainstorm/SKILL.md and
skills/planner/SKILL.md updated so new spec/plan creation produces
counter-prefixed names from the start.

The full test suite (cargo test --workspace) passes.

examples/eq_demo.ail

@@ -9,7 +9,7 @@
 ;
 ; Float has no Eq instance; partial-Float comparison is done via
 ; the explicit float_eq / float_lt / etc. fns (see
-; design/contracts/float-semantics.md).
+; design/contracts/0005-float-semantics.md).
 ;
 ; This fixture exercises all four supported types, both directly via
 ; `(app eq ...)` and indirectly via the lit-pattern desugar (which

examples/fieldtest/floats_3_safe_division.ail

@@ -16,7 +16,7 @@
 ; NOT `(== x x)` (which is false for NaN — but the LLM author who
 ; reaches for `==` first will get the right answer by accident here,
 ; only because the natural reading of the operator doesn't apply).
-; design/contracts/float-semantics.md says explicitly to use `is_nan`.
+; design/contracts/0005-float-semantics.md says explicitly to use `is_nan`.
 ;
 ; Expected stdout (one per line):
 ;   2.0      ; 6/3

examples/fieldtest/floats_4_float_to_str_reach.ail

@@ -3,7 +3,7 @@
 ; Natural task: build a label like "result = <float>" by concatenating
 ; a Str prefix with the float's text. The LLM-author who looks at
 ; `ail builtins` sees `float_to_str : (Float) -> Str`, reaches for it,
-; and gets a codegen-deferred error per design/contracts/float-semantics.md:
+; and gets a codegen-deferred error per design/contracts/0005-float-semantics.md:
 ;
 ;   `float_to_str` (Float → Str) is type-installed but codegen-
 ;   deferred to a follow-up milestone: ... Calling it typechecks but