tidy: rustdoc-sweep + drift-test-narrowing — autonomous batch

Two unrelated hygiene iters bundled because they shipped together
in one autonomous-while-Boss-away batch:

- iter rustdoc-sweep: cleared all 23 `cargo doc --workspace
  --no-deps` warnings (17 in ailang-check + 4 in ailang-core + 2
  in ailang-surface). Two warning classes: pub-doc-comment links
  to pub(crate)/private items (15 hits — replaced with plain
  backtick-code-spans), and unresolved/ambiguous links (8 hits
  — fully-qualified, disambiguated to fn-form, or escaped).
  No behaviour change; tests 562 → 562.

- iter drift-test-narrowing: design_schema_drift.rs now scans
  §"Data model" only via new helper data_model_section(),
  instead of full DESIGN.md. Closes the audit-form-a-precursor
  [high] "anchor-elsewhere-passes-silently" failure mode. All
  38 anchors verified pre-edit to live in §"Data model" so the
  tightening doesn't regress to red. New pin
  data_model_section_is_bounded guards the extractor against
  silent regression. Tests 562 → 563.

crates/ailang-surface/src/loader.rs

@@ -3,7 +3,7 @@
 //! AILang has two file forms today: Form A (`.ail`, the LLM
 //! authoring surface) and Form B (`.ail.json`, the canonical
 //! JSON-AST). These loaders accept both: for `.ail` they read the
-//! source text and parse it via [`crate::parse`]; for `.ail.json`
+//! source text and parse it via [`crate::parse()`]; for `.ail.json`
 //! they delegate to [`ailang_core::load_module`].
 //!
 //! These functions live in `ailang-surface` rather than
@@ -24,7 +24,7 @@ fn is_ail_source(path: &Path) -> bool {
 ///
 /// Dispatches on file extension:
 ///
-/// - `.ail` — read source text, parse via [`crate::parse`], return
+/// - `.ail` — read source text, parse via [`crate::parse()`], return
 ///   the in-memory [`Module`].
 /// - anything else — delegate to [`ailang_core::load_module`] and
 ///   convert its `Error` into the corresponding