design/ + source rustdoc: replace opaque shorthand with content phrases + links

Reader-facing prose and rustdoc carried opaque shorthand like
"Decision 10", "clause-5", "mq.1", "ct.1", "eob.1", "rpe.1",
"post-mq.3", and "Iter 22b.1:" with no in-repo definition the reader
could follow. This commit replaces every such occurrence in the
durable tier the reader is most likely to land on (design/ ledger +
source //! module headers + the central /// public-item rustdoc) with
an inline content phrase plus, where applicable, a Markdown link to
the file that defines the referenced concept.

design/ ledger — 16 files:
  Definition-site headings demoted from "Decision N: <title>" to
  "<title>": authoring-surface, tail-calls, memory-model section in
  rc-uniqueness.md, dual-allocator section, typeclass design,
  effects "pure core + algebraic effects".
  Cross-reference sites: "Decision 1" -> canonical-schema principle
  (data-model); "Decision 3/4" -> effects + scope-boundaries; "Decision
  6" -> authoring-surface; "Decision 8" -> tail-calls; "Decision 9" ->
  rc-uniqueness (dual-allocator); "Decision 10" -> memory-model;
  "Decision 11" -> typeclasses (model). "clause-5" -> body-link
  durability gate. "clause-3" (in language-constraints) ->
  bug-class-reintroduction discriminator. "mq.1/2/3", "ct.1/4",
  "eob.1", "rpe.1" -> the canonical-form rule / the type-driven
  dispatch / the Str carve-out / etc. "post-mq.3" -> "type-driven".

design/contracts/feature-acceptance.md: file-local "clauses 1/2/3"
-> "criteria 1/2/3" (sprachliche Kohärenz mit der File-Überschrift
"Feature-acceptance criterion"); "the clause-3 mechanism" -> "the
bug-class-reintroduction discriminator".

Source //! module headers — 24 files:
  Stripped "Iter X.Y:" prefixes and "(Decision N)" / "(mq.X)" tags
  from spec_drift, uniqueness, reuse_shape, migrate_canonical_types,
  typeclass_22b{2,3,c}, suppress_filter, lift, mono, linearity,
  diagnostic, method_dispatch_pin, method_collision_pin,
  no_per_type_print_ops, mq3_multi_class_e2e, print_mono_body_shape,
  print_no_leak_pin, cli_diag_human_workspace_load_error,
  ct1_check_cli, prose snapshot, unbound_in_instance_method_pin,
  mono_xmod_ctor_pattern, desugar.

Central /// public-item rustdoc:
  ast.rs (full sweep — every "Iter X" + "Decision N" prefix
  reformulated; mode/Type::Fn rustdoc now points at memory-model.md;
  Constraint / SuperclassRef / InstanceDef / ClassDef rustdoc points
  at typeclasses contract).
  diagnostic.rs (all "(Iter X)" / "(mq.X)" tags on diagnostic codes
  removed).
  lib.rs (FORM_A_SPEC rustdoc points at authoring-surface.md
  instead of "Decision 6").
  canonical.rs (type_hash + Float-literal rustdoc).

Still outstanding (for a follow-up commit): ~500 inline `//`
code-body comments with `Iter X.Y` markers across the workspace, and
a handful of `///` rustdoc items in hash_pin / workspace_pin / lift /
mono / suppress_filter test-pin and internal-function bodies. Code
identifiers (test filenames like `mq3_multi_class_e2e.rs`, function
names like `iter18e_drop_iterative_default_preserves_hashes`) stay
verbatim per the user's "code identifiers stay verbatim" rule.

Tests: design_index_pin 5/5 + docs_honesty_pin 5/5; workspace builds
clean; full `cargo test --workspace` previously green (every
`test result: ok` line, no FAILED line).

design/contracts/memory-model.md

@@ -32,7 +32,8 @@ schema). The substantive reasons for per-position metadata over a
   `Type` would let the schema express forms like
   `(con List (borrow Int))` — syntactically possible, semantically
   meaningless (you cannot separately own/borrow a list element
-  from the list it lives in). Decision 1 is "schema = data,
+  from the list it lives in). The
+  [canonical-schema principle](data-model.md) is "schema = data,
   schema permits exactly what is meaningful"; per-position
   metadata is the option that holds that line.
 - **Compositional clarity.** A `Type` value's identity should
@@ -62,7 +63,7 @@ identical: `param_modes` is skipped when every entry is
 `Implicit`, `ret_mode` is skipped when `Implicit`. Existing
 modules emit the same bytes as before.
 
-**Type::Con name scoping (canonical form, since ct.1).** Within a
+**Type::Con name scoping (canonical form).** Within a
 `.ail.json`, a `Type::Con.name` is interpreted relative to the
 file's top-level `"name"` field (the owning module). Bare names
 (no `.`) refer to a TypeDef in the owning module's own `defs`.
@@ -75,15 +76,16 @@ qualified references whose owner is unknown are also a violation
 (`WorkspaceLoadError::BadCrossModuleTypeRef`). The same rule
 applies to `Term::Ctor.type_name`.
 
-Class names follow the canonical-form rule (mq.1): bare for
+Class names follow the same canonical-form rule: bare for
 same-module references, `<module>.<Class>` for cross-module
-references — symmetric to `Type::Con.name`'s rule from ct.1.
+references — symmetric to `Type::Con.name`'s rule above.
 Three schema fields carry class references in this form:
 `InstanceDef.class`, `Constraint.class`, and `SuperclassRef.class`.
 `ClassDef.name` itself stays bare (defining-site context, like
 `TypeDef.name`).
 
-Method dispatch is type-driven post-mq.3 (see [Method dispatch](method-dispatch.md)):
+Method dispatch is type-driven (see
+[Method dispatch](method-dispatch.md)):
 synth resolves a `Term::Var { name: "show" }` by consulting
 the workspace's method-to-candidate-class index, filtering by
 argument type (concrete) or by declared constraint (rigid-var), and
@@ -161,24 +163,24 @@ Skipped from serialisation when empty so existing fixtures keep
 bit-identical canonical-JSON hashes (regression-pinned by
 `iter19b_empty_suppress_preserves_pre_19b_hashes` and
 `iter19b_schema_extension_preserves_pre_19b_hashes`).
-The canonical-form tightening in ct.1 shifted the hashes of two
-cross-module fixtures (`ordering_match.ail.json` and
+The canonical-form tightening for `Type::Con.name` shifted the
+hashes of two cross-module fixtures (`ordering_match.ail.json` and
 `test_22b1_dup_a.ail.json`); all intra-module fixtures, including
 the regression-pinned `sum.ail.json` and `list.ail.json`, remain
 bit-identical. The new pins are
 `ct4_migrated_fixtures_have_canonical_form_hashes` (locks the
 post-migration hashes) and
 `ct4_unmigrated_fixtures_remain_bit_identical` (re-asserts the
-existing 13a/19b/22b.1 hashes still hold).
+pre-tightening hashes still hold).
 
 ## Advisory diagnostics
 
 The advisory-diagnostics arc introduces the language's first
 **advisory** typechecker diagnostic and the suppression mechanism
-that goes with it. Decision 10's mandatory-annotation rule is
-unchanged: `param_modes` and `ret_mode` remain author-required;
-the typechecker does not infer them. What's new is feedback when
-an authored annotation is *stricter than necessary*.
+that goes with it. The mandatory-annotation rule of this memory
+model is unchanged: `param_modes` and `ret_mode` remain
+author-required; the typechecker does not infer them. What's new
+is feedback when an authored annotation is *stricter than necessary*.
 
 **The lint: `over-strict-mode`.** Fires on a
 fn-param `p` annotated `(own T)` when: