tidy: rustdoc-sweep + drift-test-narrowing — autonomous batch

Two unrelated hygiene iters bundled because they shipped together
in one autonomous-while-Boss-away batch:

- iter rustdoc-sweep: cleared all 23 `cargo doc --workspace
  --no-deps` warnings (17 in ailang-check + 4 in ailang-core + 2
  in ailang-surface). Two warning classes: pub-doc-comment links
  to pub(crate)/private items (15 hits — replaced with plain
  backtick-code-spans), and unresolved/ambiguous links (8 hits
  — fully-qualified, disambiguated to fn-form, or escaped).
  No behaviour change; tests 562 → 562.

- iter drift-test-narrowing: design_schema_drift.rs now scans
  §"Data model" only via new helper data_model_section(),
  instead of full DESIGN.md. Closes the audit-form-a-precursor
  [high] "anchor-elsewhere-passes-silently" failure mode. All
  38 anchors verified pre-edit to live in §"Data model" so the
  tightening doesn't regress to red. New pin
  data_model_section_is_bounded guards the extractor against
  silent regression. Tests 562 → 563.

crates/ailang-core/src/workspace.rs

@@ -90,7 +90,7 @@ pub struct Registry {
     /// defining module. Used by [`Self::normalize_type_for_lookup`] to
     /// rewrite a bare `Type::Con.name` to its always-qualified form
     /// before computing the registry key. Primitives are not present.
-    /// Populated in [`build_registry`] from the same scan that builds
+    /// Populated in `build_registry` from the same scan that builds
     /// the entry map.
     ///
     /// Keyed by `(owning_module, bare_name)`, value is the
@@ -99,7 +99,7 @@ pub struct Registry {
     /// module M is `(M, "Foo")`, bare `Foo` from module N is
     /// `(N, "Foo")`, and the two carry distinct canonical
     /// qualifications under
-    /// [`normalize_type_for_registry`]. Pre-ctt.2 the key was
+    /// `normalize_type_for_registry`. Pre-ctt.2 the key was
     /// the bare name alone, and a workspace with two `type Foo`
     /// declarations silently overwrote one entry, then tripped
     /// `DuplicateInstance` on the loser-side instance after
@@ -441,7 +441,7 @@ pub fn load_workspace(entry_path: &Path) -> Result<Workspace, WorkspaceLoadError
 /// Load a workspace using a caller-supplied per-module loader.
 ///
 /// The standard entry point [`load_workspace`] is a thin wrapper that
-/// passes [`load_one`] as the loader and so only accepts `.ail.json`
+/// passes `load_one` as the loader and so only accepts `.ail.json`
 /// files. Pass a different loader (for example, an extension-dispatching
 /// loader from `ailang-surface`) to accept `.ail` source files as well.
 ///