iter prep.3-kernel-tier-modules (DONE 9/9): kernel-tier modules + param-in + stub crate — closes #33

Terminal iteration of the kernel-extension-mechanics milestone. Ships
the four language-level mechanisms named in the spec's § Goal:
Module.kernel + TypeDef.param-in schema, their Form-A surface,
flag-driven kernel-tier auto-injection, and generic param-in checker
enforcement with a new diagnostic.

Schema (Tasks 1+2). Module gains a `kernel: bool` field
(skip_serializing_if = is_false), TypeDef gains a
`param_in: BTreeMap<String, BTreeSet<String>>` field
(skip-if-empty, kebab-renamed to "param-in"). Both fields are
strictly additive — every pre-existing fixture's canonical-JSON hash
is bit-stable except `prelude.ail`, which intentionally gains
`(kernel)`. The struct-literal sweep covered ~104 Module sites and
~35 TypeDef sites across the workspace; the additive serde-default
covers JSON deserialise paths, only Rust struct literals broke.

Form-A surface (Tasks 3+4). `(kernel)` is a bare module-header
attribute; `(param-in (a Int Float) (b Str))` is one outer
TypeDef-body clause carrying one or more inner var-lists (OQ1
decision — mirrors `(ctors …)`, one parser arm, deterministic
BTreeMap iteration). Both round-trip Form-A → JSON → Form-A
bit-identical.

Workspace-load migration (Task 5). The hardcoded `&["prelude"]`
literal at loader.rs:108 became a `modules.values().filter(|m|
m.kernel)` derivation; `parse_prelude()` injection stays because
the prelude has no on-disk manifest in user workspaces. Prelude
now carries `(kernel)` in its source, so the new filter picks it
up automatically. Code-path migration only — observable behaviour
is identical (prelude_free_fns.rs stays green). prelude hash
re-pinned (af372f28c726f29f) with Honesty-Rule provenance comment.
WorkspaceLoadError::ReservedModuleName diagnostic prose
repurposed: any built-in kernel module name is reserved
(currently prelude + kernel_stub), not specifically prelude. CLI
mapping at main.rs updated in lockstep.

Stub crate (Task 6). New `crates/ailang-kernel-stub/` is a
zero-dependency leaf crate carrying only `pub const STUB_AIL:
&str` with the Form-A source of the kernel_stub module (one
parametric TypeDef with param-in, one ctor). The parse hop —
`parse_kernel_stub()` — lives in ailang-surface next to
parse_prelude, keeping the crate-dependency graph acyclic
(`ailang-surface → ailang-kernel-stub → ailang-core`, no
back-edge). The stub is injected unconditionally in all builds as
the ratifying fixture for the kernel-extension mechanism; future
base extensions may add more or retire the stub. Drift-pinned by
`kernel_stub_module_round_trips`.

Checker (Task 7). New `CheckError::ParamNotInRestrictedSet`
variant + code() + ctx() arms + enforcement in
`check_type_well_formed`'s Type::Con arm — generic, data-driven
from the TypeDef, mentions no specific extension type. Two
in-source tests pin both the rejection (`Str` outside `{Int,
Float}`) and the acceptance (`Int` inside) paths.

Workspace-load integration tests (Task 8). New
`workspace_kernel.rs` integration-test crate with three tests:
auto-import without explicit `(import …)` declaration, two
kernel-tier modules co-load, explicit-import-overrides-auto-
import precedence preserved. Loader is import-tree-only so the
auto-import tests use a bridge module that brings the kernel
module into the workspace via the import graph — docstring
captures the reachability nuance for future readers.

Doc-state transitions (Task 9). INDEX.md kernel-extensions row
annotation transitions from "design accepted 2026-05-28; impl in
progress" to "mechanisms milestone closed 2026-05-28; raw-buf and
series milestones pending". Whitepaper STATUS + auto-import +
param-in sections transitioned forward→present for shipped
mechanisms; forward-tense survives only in sections describing
the still-pending raw-buf/series milestones (per Honesty-Rule).
data-model contract gains anchor blocks for both new schema
fields.

Side-effect: every binary's IR snapshot now contains ~52 lines
for `drop_kernel_stub_StubT` because the stub is auto-injected
into every workspace load. Snapshots refreshed; e2e expects 4
modules per workspace (prelude + kernel_stub + entry + zero or
more user modules) instead of the previous 3.

Plan defects scrubbed in the implementation (folded back into
the planner template via the planner's self-review checklist
next time): Task 4 sample test src used fictional
`(ctors (MkT a))` list form (project grammar is per-`(ctor MkT
a)`); Task 6 original wiring would have created a cycle
ailang-surface → ailang-kernel-stub → ailang-surface (inverted —
stub crate is zero-dep, parse hop lives in surface); Task 7 in-
source tests referenced a fictional `check_type_in_module`
helper (used the existing Workspace + check_workspace
convention); Task 8 first integration test expected loader to
auto-load kernel modules from disk (loader is import-tree-only;
tests use a bridge module).

Concern-5 fix folded in pre-commit: workspace.rs ReservedModuleName
doc-prose initially said "in test/dev builds" for kernel_stub —
but stub is unconditionally injected in all builds. Doc copy
tightened to present-state per Honesty-Rule.

Stats: 0 spec-review-loops, 0 quality-review-loops, 2 sweep-script
retries on Task 2 (brace-depth bug on nested vec![Ctor{…}],
recovered via per-file checkout + rewritten anchor-on-existing-
field sweep), 1 e2e-snapshot refresh on Task 6.

crates/ailang-codegen/src/lib.rs

@@ -3581,6 +3581,7 @@ mod tests {
         let m = Module {
             schema: SCHEMA.into(),
             name: "t".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![
                 Def::Fn(FnDef {
@@ -3651,6 +3652,7 @@ mod tests {
         let m = Module {
             schema: SCHEMA.into(),
             name: "noentry".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![Def::Fn(FnDef {
                 name: "helper".into(),
@@ -3701,6 +3703,7 @@ mod tests {
         let m = Module {
             schema: SCHEMA.into(),
             name: "rclist".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![
                 Def::Type(TypeDef {
@@ -3724,6 +3727,7 @@ mod tests {
                     ],
                     doc: None,
                     drop_iterative: false,
+                    param_in: BTreeMap::new(),
                 }),
                 Def::Fn(FnDef {
                     name: "main".into(),
@@ -3788,6 +3792,7 @@ mod tests {
         let m = Module {
             schema: ailang_core::SCHEMA.to_string(),
             name: "t".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![
                 Def::Const(ConstDef {
@@ -3863,6 +3868,7 @@ mod tests {
         let m = Module {
             schema: ailang_core::SCHEMA.to_string(),
             name: "t".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![
                 fn_def("ai", plus_int, Type::int()),
@@ -3928,6 +3934,7 @@ mod tests {
         let m = Module {
             schema: ailang_core::SCHEMA.to_string(),
             name: "t".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![
                 fn_def("ni", neg_int, Type::int()),
@@ -3977,6 +3984,7 @@ mod tests {
         let m = Module {
             schema: ailang_core::SCHEMA.to_string(),
             name: "t".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![
                 fn_def("k_nan", Term::Var { name: "nan".into() }),
@@ -4002,6 +4010,7 @@ mod tests {
         let m = Module {
             schema: SCHEMA.into(),
             name: "prelude".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![
                 Def::Fn(FnDef {
@@ -4064,6 +4073,7 @@ mod tests {
         let m = Module {
             schema: SCHEMA.into(),
             name: "prelude".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![
                 Def::Fn(FnDef {
@@ -4128,6 +4138,7 @@ mod tests {
         let m = Module {
             schema: SCHEMA.into(),
             name: "t".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![Def::Fn(FnDef {
                 name: "main".into(),
@@ -4226,6 +4237,7 @@ mod tests {
             ],
             doc: None,
             drop_iterative: false,
+            param_in: BTreeMap::new(),
         });
         // Ordering is `ptr` at the LLVM level (boxed ADT).
         let compare = Def::Fn(FnDef {
@@ -4261,6 +4273,7 @@ mod tests {
         Module {
             schema: SCHEMA.into(),
             name: "prelude".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![ordering, compare, main_def],
         }
@@ -4278,6 +4291,7 @@ mod tests {
         let m = Module {
             schema: SCHEMA.into(),
             name: "t".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![
                 Def::Const(ConstDef {
@@ -4320,6 +4334,7 @@ mod tests {
         let m = Module {
             schema: SCHEMA.into(),
             name: "t".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![Def::Fn(FnDef {
                 name: "main".into(),
@@ -4361,6 +4376,7 @@ mod tests {
         let m = Module {
             schema: SCHEMA.into(),
             name: "t".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![Def::Fn(FnDef {
                 name: "main".into(),
@@ -4420,6 +4436,7 @@ mod tests {
         let m = Module {
             schema: SCHEMA.into(),
             name: "prelude".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![
                 Def::Fn(FnDef {
@@ -4516,6 +4533,7 @@ mod tests {
         let m = Module {
             schema: SCHEMA.into(),
             name: "t".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![Def::Fn(FnDef {
                 name: "main".into(),
@@ -4556,6 +4574,7 @@ mod tests {
         let m = Module {
             schema: SCHEMA.into(),
             name: "t".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![Def::Fn(FnDef {
                 name: "main".into(),
@@ -4597,6 +4616,7 @@ mod tests {
         let m = Module {
             schema: SCHEMA.into(),
             name: "t".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![Def::Fn(FnDef {
                 name: "main".into(),
@@ -4638,6 +4658,7 @@ mod tests {
         let m = Module {
             schema: SCHEMA.into(),
             name: "t".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![Def::Fn(FnDef {
                 name: "main".into(),
@@ -4679,6 +4700,7 @@ mod tests {
         let m = Module {
             schema: SCHEMA.into(),
             name: "t".into(),
+            kernel: false,
             imports: vec![],
             defs: vec![Def::Fn(FnDef {
                 name: "main".into(),