convention: counter-prefix file naming across docs/specs/, docs/plans/, design/contracts/, design/models/

All 176 files in the four accumulating directories now use a
zero-padded 4-digit counter prefix that reflects creation order
(`NNNN-slug.md`). The counter is assigned per directory in strict
git-log creation order; ties broken alphabetically by original name.
The old `YYYY-MM-DD-` prefix on docs/specs/ and docs/plans/ files is
dropped — the date is recoverable from git log and the counter
carries the ordering.

A file's counter is stable for the life of the file: never reassigned,
never reused, never compacted. Deleted files retire their counter;
subsequent files do not fill the gap. This is the property that lets
cross-references stay literal — refs use the full filename including
the counter (`design/contracts/0007-honesty-rule.md`) so they grep
cleanly and resolve directly without a glob step.

313 cross-references updated across .md/.rs/.toml/.c/.json files
(test pins, include_str! paths, design-INDEX entries, baseline notes,
runtime C comments, inter-contract markdown links incl. bare basename
and `../models/foo.md` forms).

CLAUDE.md gets a new "File-naming convention" section spelling out
the rule and rationale. skills/brainstorm/SKILL.md and
skills/planner/SKILL.md updated so new spec/plan creation produces
counter-prefixed names from the start.

The full test suite (cargo test --workspace) passes.

runtime/rc.c

@@ -40,7 +40,7 @@
  * lambda envs, etc.
  *
  * FROZEN ABI for the embedding boundary — see
- * design/contracts/frozen-value-layout.md. A boundary-crossing
+ * design/contracts/0006-frozen-value-layout.md. A boundary-crossing
  * single-ctor scalar record's box offsets MUST NOT move.
  *
  * Threading: the per-object refcount header ops and the per-ctx RC

runtime/str.c

@@ -198,7 +198,7 @@ char *ailang_bool_to_str(bool b) {
  * the trailing NUL. Works uniformly on static-Str and heap-Str
  * inputs because the consumer ABI (i64 len at offset 0, bytes
  * starting at offset 8, NUL at offset 8 + len) is identical
- * between realisations (see design/contracts/str-abi.md); the rc_header at
+ * between realisations (see design/contracts/0011-str-abi.md); the rc_header at
  * offset -8 — present only on heap-Str — is never consulted.
  *
  * Used by `show__Str` (parent spec milestone 24): converts a
@@ -224,7 +224,7 @@ char *ailang_str_clone(const char *src) {
  * memcpys both payloads in order, NUL-terminates, returns the new
  * payload pointer. Like `str_clone`, this works uniformly on static-
  * Str and heap-Str inputs because the consumer ABI is identical
- * between realisations (see design/contracts/str-abi.md).
+ * between realisations (see design/contracts/0011-str-abi.md).
  *
  * Used by Show bodies that want labelled output (e.g.
  * `"Item " ++ int_to_str n`) and by any caller that needs to