iter it.2: structural-guardedness checker + first real Diverge effect

Iteration-discipline milestone, 2 of 3. Strictly additive (nothing
tail-related removed; that is it.3). New whole-body pass
verify_structural_recursion sibling of verify_tail_positions
(DD-1): smaller-set algorithm with implicit candidate inference +
unconstrained accumulators (DD-2, foldl=structural), self/mutual
via inline ADT-family union-find (DD-3), it.2-only tail==false
grandfather. CheckError::NonStructuralRecursion. term_contains_loop
(stops at Term::Lam, DD-4) injects Diverge so existing
UndeclaredEffect enforces it, no new variant; lam-arrow + LetRec
sub-effect sites wired. DESIGN.md Decision 3 synced. Four it.1
loop fixtures gained !Diverge.

Two spec-premise boundary defects surfaced + resolved within the
additive invariant (corpus clean, check not weakened), recorded as
corrected it.3 corpus-migration scope: (1) the "21 tail-app
fixtures" grandfather premise under-counts the corpus —
no-ADT-candidate counter recursions have no structural position to
verify, deferred to it.3; (2) two RC-regression fixtures joined the
spec's transitional tail-app grandfather as the other 20 do (RC==GC
guards verified still green). cargo test --workspace 622/0; 9
acceptance pins non-vacuous. Spec fda9b78, plan bc9f512.

crates/ail/tests/e2e.rs

@@ -2853,6 +2853,31 @@ fn loop_in_lambda_runs_and_prints_49() {
     assert_eq!(stdout.trim(), "49", "loop_in_lambda must print 49, got {stdout:?}");
 }
 
+/// Iter it.2 Phase-3: an it.2-clean structural recursion that runs.
+/// `struct_rec_sum_e2e` sums [1,2,3,4,5] via plain non-tail
+/// recursion on the Cons tail — the it.2 guardedness check
+/// classifies it pure + total (no `!Diverge`, no `tail-app`). This
+/// gate proves the structural-recursion "total" verdict is
+/// behaviourally sound, not merely a typecheck assertion: a plain
+/// (musttail-free) structurally-decreasing recursive call lowers
+/// and runs to the correct value.
+#[test]
+fn struct_rec_sum_runs_and_prints_15() {
+    let stdout = build_and_run("struct_rec_sum_e2e.ail");
+    assert_eq!(stdout.trim(), "15", "struct_rec_sum must print 15, got {stdout:?}");
+}
+
+/// Iter it.2 Phase-3: the `Diverge`-path twin. `loop_needs_diverge`
+/// declares `!Diverge` (loop-bearing per DD-4) and runs the it.1
+/// accumulator loop to 55 — proving the Diverge-effect injection is
+/// purely a typecheck-layer obligation with no codegen impact (the
+/// loop lowers and runs identically to its pre-it.2 it.1 form).
+#[test]
+fn loop_needs_diverge_runs_and_prints_55() {
+    let stdout = build_and_run("loop_needs_diverge.ail");
+    assert_eq!(stdout.trim(), "55", "loop_needs_diverge must print 55, got {stdout:?}");
+}
+
 /// Iter mut.3: Float twin of `mut_counter_prints_55`. The mut-var
 /// is `Float`, init is `0.0`, the recursive helper returns the
 /// sum 1.0+...+10.0 = 55.0. The polymorphic `print` routes through