fix: 18g.2 — let-binder drop for Own-returning App

18c.3's is_rc_heap_allocated returned false for any Term::App
shape; the doc-comment explicitly deferred the owned-returning-call
case to 'later iters tied to (own) ret-mode contracts'. We have
those contracts (Iter 18a). With this iter the predicate widens to
recognise Term::App whose callee carries ret_mode=Own; the let-
scope close emits a drop call, routing through the per-type drop
fn derived from the call's return type so the cascade walks ptr
children correctly.

Borrow- and Implicit-returning calls are still not trackable —
they don't carry the static caller-owns-the-return signal.

drop_symbol_for_binder gains an App arm that synthesises the
return type and resolves drop_<m>_<T> from it (same shape as the
existing Ctor arm), with cross-module qualification through
import_map. emit_inlined_partial_drop now defaults to shallow
ailang_rc_dec when value is not Term::Ctor — that path is the
dynamic-tag partial-drop debt 18d.4 already documents (the
runtime tag of a let-binder whose value is Term::App is not
statically known, so per-field partial-drop emission is not
usable; closing this remaining leak path requires a tag-
conditional helper, queued as future work).

Red: alloc_rc_let_binder_for_owned_returning_app_drops_at_scope_close
on examples/rc_let_owned_app_leak — pre-fix live=3 (TNode + 2
TLeaf), post-fix live=0.

End-to-end: bench_latency_explicit under --alloc=rc now reports
allocs=11068575 frees=11068575 live=0. The depth-19 Tree cache
+ all 10M per-op IntList cells deallocate cleanly. Decision
10's prompt-deallocation property now holds end-to-end on the
canonical bench fixture.

crates/ail/tests/e2e.rs

@@ -2124,3 +2124,40 @@ fn alloc_rc_explicit_mode_tail_sum_does_not_leak_outer_cells() {
          and no drop site emits the shallow rc_dec for the moved-from outer LCons cell"
     );
 }
+
+/// Iter 18g.2 regression: a `let`-binder whose value is the result of
+/// an Own-returning function call must be dropped at let-scope close.
+///
+/// Background: 18c.3's `is_rc_heap_allocated` returns `false` for any
+/// `Term::App` shape (the doc-comment explicitly defers the
+/// owned-returning-call case to "later iters tied to `(own)` ret-mode
+/// contracts"). With Iter 18a's mode contracts in place, that
+/// limitation is no longer load-bearing — the call's `ret_mode == Own`
+/// is the static signal that a fresh heap allocation has flowed into
+/// the binder, and the let-scope close is the right place to dec it.
+///
+/// 18f.2's bench surfaced the user-visible cost: in
+/// `(let t (app build_tree 19) ...)`, `t` was not trackable and the
+/// depth-19 Tree (~1M cells) leaked at every program exit.
+///
+/// Pre-fix on this minimal fixture: `live = 3` (one TNode + two TLeaf
+/// children).
+/// Post-fix: `live = 0`.
+#[test]
+fn alloc_rc_let_binder_for_owned_returning_app_drops_at_scope_close() {
+    let (stdout, allocs, frees, live) =
+        build_and_run_with_rc_stats("rc_let_owned_app_leak.ail.json");
+    assert_eq!(
+        stdout.trim(),
+        "1",
+        "pin(TNode) returns 1 regardless of leak status"
+    );
+    assert_eq!(
+        live, 0,
+        "let-binder for an Own-returning app leaked {live} cells \
+         (allocs={allocs} frees={frees}); is_rc_heap_allocated must \
+         recognise Term::App with ret_mode=Own as trackable, and the \
+         drop-symbol resolution must derive drop_<m>_<T> from the \
+         call's return type"
+    );
+}