iter 23.4: mono-pass unification — class methods + polymorphic free fns in one fixpoint

Restructure ailang-check/src/mono.rs::monomorphise_workspace into a
single specialiser over every Type::Forall-quantified Def::Fn, covering
both class-method residuals AND polymorphic free-fn call sites in one
fixpoint pass. Remove the codegen-time specialiser (lower_polymorphic_call,
module_polymorphic_fns, mono_queue, mono_emitted, emit_specialised_fn,
plus the now-dead helpers apply_subst_to_term, descriptor_for_subst,
type_descriptor) entirely. Codegen sees only monomorphic Def::Fns after
this iter — no polymorphic call sites, no codegen-time queue.

Architecture changes:
- MonoTarget: struct → enum with ClassMethod / FreeFn variants; dedup
  keys are guaranteed-disjoint via 'class'/'free' first component.
- collect_mono_targets: new FreeFnCall channel through synth (cleaner
  than the plan's separate-walker proposal — one less data flow,
  substitution tracking comes 'for free' via fresh metavars +
  post-synth subst.apply). Plan Step 4.4 (polymorphic_free_fns env
  field) consequently obsolete.
- synthesise_mono_fn_for_free_fn: new free-fn entry point; substitutes
  rigid vars in BOTH the type AND the body (body substitution required
  because free-fn bodies carry inner Lams whose param_tys reference
  outer Forall vars — adapted from plan's 'body unchanged' sketch).
- mono_symbol_n: N-ary extension of mono_symbol; bit-stable for the
  single-type-var case (hash-stability pin Task 1 fires zero times
  through all eight refactor tasks).
- rewrite_class_method_calls → rewrite_mono_calls; interleaved-slot
  collector preserves the positional-cursor invariant across both
  channels.
- workspace_has_typeclasses → workspace_has_specialisable_targets
  (principled correctness; old predicate happened to already be true
  for every user workspace because the prelude is auto-injected).

Codegen cleanup:
- Two call sites of lower_polymorphic_call deleted (codegen/src/lib.rs
  lines ~1939-1945, ~1965-1973).
- lower_polymorphic_call body, module_polymorphic_fns field +
  population + Emitter wiring, mono_queue / mono_emitted, drain loop,
  emit_specialised_fn — all removed.
- is_static_callee collapsed to module_user_fns-only.
- subst.rs apply_subst_to_term + descriptor_for_subst removed; synth.rs
  type_descriptor removed (all dead post-removal).
- ail emit-ir command pipeline gains lift_letrecs + monomorphise_workspace
  pre-passes (pre-iter-23.4 the codegen-time poly path was masking
  this dependency — emit-ir is now consistent with build).
- Net codegen reduction: -285 lines lib.rs, -93 lines subst.rs.

Tests:
- mono_hash_stability.rs (new): regression pin for six primitive Eq/Ord
  mono-symbol body hashes; stayed bit-stable through all eight refactor
  tasks.
- mono_unification.rs (new): six tests covering variant-key disjointness,
  free-fn target emission, free-fn synthesis with rigid substitution,
  rewrite walker on free fns, identity for poly-free-fn-only workspaces,
  end-to-end cmp_max_smoke runtime correctness.
- typeclass_22b3.rs: three test sites updated to MonoTarget::ClassMethod
  enum form.
- 73 e2e + 18 typeclass + 81 codegen tests all green workspace-wide.

DESIGN.md §'Monomorphisation (post-typecheck, pre-codegen)' amended:
two-arm fixpoint described, disjoint-keyed dedup, cursor-aligned
walker, removed codegen-time path.

Bench check (all exit 0, 112 metrics stable): bench/check.py +
compile_check.py + cross_lang.py.

Plan parent: docs/plans/2026-05-11-iter-23.4.md (fab1685).
Spec parent: docs/specs/2026-05-11-23-eq-ord-prelude.md (841d65d).
Per-iter journal documents two adapted deviations from the plan
(synth-channel vs separate walker; body substitution; emit-ir fix);
no spec defects.

crates/ailang-codegen/src/synth.rs

@@ -196,48 +196,11 @@ pub(crate) fn builtin_effect_op_ret(op: &str) -> Option<Type> {
     })
 }
 
-/// Iter 12b: a stable, identifier-safe descriptor for a `Type`.
-/// Maps `Int → I`, `Bool → B`, `Unit → U`, `Str → S`, ADT name `Foo →
-/// FFoo`, fn → `F<params...>R<ret>` (no recursion guard since types in
-/// the MVP are non-recursive at the type level).
-pub(crate) fn type_descriptor(t: &Type) -> String {
-    match t {
-        Type::Con { name, args } => {
-            let head = match name.as_str() {
-                "Int" => "I".into(),
-                "Bool" => "B".into(),
-                "Unit" => "U".into(),
-                "Str" => "S".into(),
-                "Float" => "Fl".into(),
-                other => format!("F{other}"),
-            };
-            if args.is_empty() {
-                head
-            } else {
-                // Iter 13a: parameterised ADTs get their type-arg
-                // descriptors appended, e.g. `FBox` of `Int` → `FBox_I`.
-                let mut s = head;
-                for a in args {
-                    s.push('_');
-                    s.push_str(&type_descriptor(a));
-                }
-                s
-            }
-        }
-        Type::Fn { params, ret, .. } => {
-            let mut s = String::from("Fn");
-            for p in params {
-                s.push('_');
-                s.push_str(&type_descriptor(p));
-            }
-            s.push_str("__r_");
-            s.push_str(&type_descriptor(ret));
-            s
-        }
-        Type::Var { name } => format!("V{name}"),
-        Type::Forall { .. } => "FORALL".into(),
-    }
-}
+// iter 23.4: `type_descriptor` was the helper that mangled a `Type`
+// into an identifier-safe suffix for the codegen-side mono mangling
+// (`Int → I`, `Bool → B`, etc.). The unified mono pass produces
+// surface-named mono symbols instead (`Int → "Int"`, parameterised
+// via 8-hex hash) — see `ailang_check::mono::mono_symbol_n`.
 
 /// Floats iter 4.2: arithmetic / comparison ops are type-dispatched
 /// over `{Int, Float}`. Caller (`lower_app`) resolves the arg type