feat(codegen): switch the lowering walk from &Term to typed &MTerm (mir.1b)

Atomic completion of spec iteration mir.1 (docs/specs/0060-typed-mir.md):
codegen now consumes the typed MIR produced by `lower_to_mir` instead of
re-deriving types from the bare `ast::Term`. Every codegen helper that
took `&Term` (lower_term, lower_app, drop.rs, match_lower.rs) takes
`&MTerm` and reads each node's checker-proved type off `MTerm::ty()`.
The build path is `Workspace -> elaborate_workspace -> MirWorkspace ->
lower_workspace`; the public `lower_workspace*` entry points and their 18
call sites thread `&MirWorkspace`. The codegen-side type re-derivers
`synth_with_extras` + `synth_arg_type` (and the `builtin_ail_type` /
`builtin_effect_op_ret` mirror tables) are deleted — grep-clean. The
three re-derivers the spec keeps until mir.2/mir.3 (`type_home_module`,
`is_static_callee`, the second `infer_module_with_cross`) stay.

The mechanical Term->MTerm match-arm conversion was straightforward and
compiler-enforced. The substance was a set of producer-side correctness
gaps that only surface once codegen reads `MTerm::ty()` and once the
build path re-synthesises the post-mono AST through the canonical
`synth` (which, unlike the old codegen, fully re-unifies). Each was
root-caused against a failing e2e fixture:

1. `qualify_local_types` stripped fn-type modes (rebuilt `Type::Fn` with
   empty `param_modes` / `Implicit` `ret_mode`), so a monomorphised
   polymorphic intrinsic (`RawBuf.set`) lost its `Own` ret-mode and the
   owned temporary leaked at the call site. Made mode-preserving, like
   its sister `qualify_workspace_types` and `Subst::apply` (449df13).

2. `lower_to_mir::synth_pure` synthesises each node in isolation, so a
   nullary polymorphic ctor (`Nil : List<a>`) left its element type an
   unbound `$m` metavar that the canonical synth never pins. Codegen's
   mono unifier (`unify_for_subst`) already has a wildcard for exactly
   this — `$u`, the spelling the now-deleted codegen synth used — so the
   typed-MIR boundary normalises every residual `$m` to `$u` once
   (`wildcard_residual_metavars`), rather than teaching each consumer to
   tolerate a raw metavar.

3. The class-method mono arm (`synthesise_mono_fn`) substituted the
   registry-canonical *qualified* instance type into a method appended to
   the instance's own module, minting a `show_user_adt.IntBox` param
   against a bare-`IntBox` body. Localised to bare before substitution,
   symmetric to the free-fn arm (600565d).

4. Monomorphisation synthesises *downward* class-dispatch references —
   prelude's `print__<IntBox>` names the instance module `show_user_adt`
   that prelude never imports. The post-mono re-synth in `lower_module`
   seeds every workspace module name as an identity import (excluding the
   current module, to keep own types bare) so the qualified-var path
   resolves these; the canonical `synth` used by `check_workspace` stays
   strict.

5. Post-mono, a cross-module callee can name the consumer's *own* ADT
   qualified (`show_user_adt.IntBox`) where the consumer synthesises it
   bare — a spelling split that cannot exist pre-mono (the param is
   polymorphic there). synth's App arm strips the current module's own
   qualifier from both sides before unifying (`strip_own_module_qual`),
   a no-op pre-mono.

Acceptance: whole workspace suite green (698 tests); `e2e` 98/98 and
`show_print_e2e` 3/3; `synth_with_extras`/`synth_arg_type` grep-clean in
codegen; #51/#53 fixtures build and run; lower_to_mir_ty pins green. The
#49 heap-Str loop-binder leak remains ignored (lifts at mir.4).

Builds on the standalone producer fix (600565d, free-fn own-ADT
localisation) and the two standalone mode-preservation fixes
(449df13 Subst::apply); those landed separately as they are
independently correct and inert on the old codegen.

crates/ailang-codegen/src/synth.rs

@@ -56,142 +56,11 @@ pub(crate) fn fn_sig_from_type(t: &Type) -> Option<FnSig> {
     None
 }
 
-/// AILang type of a builtin operator. Used by
-/// `synth_arg_type` for arg-type inference at polymorphic call sites.
-/// Mirrors what the typechecker installs in its env via `builtins`.
-pub(crate) fn builtin_ail_type(name: &str) -> Option<Type> {
-    // same widening as `crates/ailang-check/src/
-    // builtins.rs` — `+`/`-`/`*`/`/` and `!=`/`<`/`<=`/`>`/`>=` are
-    // polymorphic. `%` stays monomorphic-Int. Codegen lowering for
-    // these ops still goes through `builtin_binop` (Int-only) in
-    // iter 3; iter 4 converts that to type-dispatched.
-    let poly_a_a_to_a = || Type::Forall {
-        vars: vec!["a".into()],
-        constraints: vec![],
-        body: Box::new(Type::Fn {
-            params: vec![
-                Type::Var { name: "a".into() },
-                Type::Var { name: "a".into() },
-            ],
-            ret: Box::new(Type::Var { name: "a".into() }),
-            effects: vec![],
-            param_modes: vec![],
-            ret_mode: ParamMode::Implicit,
-        }),
-    };
-    // 2026-05-21 operator-routing-eq-ord: `poly_a_a_to_bool` was
-    // shared by the six comparator builtins. With those names
-    // deleted from the surface, the helper is dead.
-    let int_int_int = || Type::Fn {
-        params: vec![Type::int(), Type::int()],
-        ret: Box::new(Type::int()),
-        effects: vec![],
-        param_modes: vec![],
-        ret_mode: ParamMode::Implicit,
-    };
-    Some(match name {
-        "+" | "-" | "*" | "/" => poly_a_a_to_a(),
-        "%" => int_int_int(),
-        // 2026-05-21 operator-routing-eq-ord: the six comparator
-        // names (`==` / `!=` / `<` / `<=` / `>` / `>=`) are no
-        // longer surface identifiers. Equality / ordering route
-        // through the class methods `eq` / `compare` (prelude.Eq /
-        // Ord); Float comparison routes through the named fns
-        // `float_eq` / `float_lt` / etc. Neither path needs an
-        // entry in this codegen-side mirror table.
-        "not" => Type::Fn {
-            params: vec![Type::bool_()],
-            ret: Box::new(Type::bool_()),
-            effects: vec![],
-            param_modes: vec![],
-            ret_mode: ParamMode::Implicit,
-        },
-        // `__unreachable__` is the polymorphic bottom value
-        // (`forall a. a`). Mirrors the typechecker's `builtins::install`.
-        "__unreachable__" => Type::Forall {
-            vars: vec!["a".into()],
-            constraints: vec![],
-            body: Box::new(Type::Var { name: "a".into() }),
-        },
-        // Float-conversion and inspection builtins.
-        // Same lockstep with `crates/ailang-check/src/builtins.rs`.
-        "neg" => Type::Forall {
-            vars: vec!["a".into()],
-            constraints: vec![],
-            body: Box::new(Type::Fn {
-                params: vec![Type::Var { name: "a".into() }],
-                ret: Box::new(Type::Var { name: "a".into() }),
-                effects: vec![],
-                param_modes: vec![],
-                ret_mode: ParamMode::Implicit,
-            }),
-        },
-        "int_to_float" => Type::Fn {
-            params: vec![Type::int()],
-            ret: Box::new(Type::float()),
-            effects: vec![],
-            param_modes: vec![],
-            ret_mode: ParamMode::Implicit,
-        },
-        "float_to_int_truncate" => Type::Fn {
-            params: vec![Type::float()],
-            ret: Box::new(Type::int()),
-            effects: vec![],
-            param_modes: vec![],
-            ret_mode: ParamMode::Implicit,
-        },
-        "float_to_str" => Type::Fn {
-            params: vec![Type::float()],
-            ret: Box::new(Type::str_()),
-            effects: vec![],
-            param_modes: vec![],
-            ret_mode: ParamMode::Own,
-        },
-        "int_to_str" => Type::Fn {
-            params: vec![Type::int()],
-            ret: Box::new(Type::str_()),
-            effects: vec![],
-            param_modes: vec![],
-            ret_mode: ParamMode::Own,
-        },
-        "bool_to_str" => Type::Fn {
-            params: vec![Type::bool_()],
-            ret: Box::new(Type::str_()),
-            effects: vec![],
-            param_modes: vec![],
-            ret_mode: ParamMode::Own,
-        },
-        "str_clone" => Type::Fn {
-            params: vec![Type::str_()],
-            ret: Box::new(Type::str_()),
-            effects: vec![],
-            param_modes: vec![ParamMode::Borrow],
-            ret_mode: ParamMode::Own,
-        },
-        "is_nan" => Type::Fn {
-            params: vec![Type::float()],
-            ret: Box::new(Type::bool_()),
-            effects: vec![],
-            param_modes: vec![],
-            ret_mode: ParamMode::Implicit,
-        },
-        // Float bit-pattern constants. Bare values,
-        // not fns — referenced via `Term::Var`. Mirrors the
-        // typechecker's `builtins::install`. Codegen emits LLVM hex-
-        // float literals at the use site in iter 4.
-        "nan" | "inf" | "neg_inf" => Type::float(),
-        _ => return None,
-    })
-}
-
-/// AILang return type of a built-in effect op. The op's
-/// param signature is irrelevant here since we only consume the ret.
-pub(crate) fn builtin_effect_op_ret(op: &str) -> Option<Type> {
-    Some(match op {
-        "io/print_str" => Type::unit(),
-        _ => return None,
-    })
-}
+// mir.1b: `builtin_ail_type` (the codegen-side mirror of a builtin's
+// AILang type) and `builtin_effect_op_ret` were read only by the
+// codegen-side type re-derivation deleted in this iteration. Codegen
+// now reads `MTerm::ty()` off the typed MIR, so the mirror table is
+// gone — both definitions removed.
 
 // iter 23.4: `type_descriptor` was the helper that mangled a `Type`
 // into an identifier-safe suffix for the codegen-side mono mangling
@@ -200,8 +69,8 @@ pub(crate) fn builtin_effect_op_ret(op: &str) -> Option<Type> {
 // via 8-hex hash) — see `ailang_check::mono::mono_symbol_n`.
 
 /// Floats iter 4.2: arithmetic / comparison ops are type-dispatched
-/// over `{Int, Float}`. Caller (`lower_app`) resolves the arg type
-/// via `synth_arg_type` and passes it here. Returns the
+/// over `{Int, Float}`. Caller (`lower_app`) reads the arg type off
+/// `MTerm::ty()` and passes it here. Returns the
 /// `(instruction, operand_llvm_type, result_llvm_type)` triple to
 /// emit. `%` stays Int-only.
 ///