design/ + source rustdoc: replace opaque shorthand with content phrases + links

Reader-facing prose and rustdoc carried opaque shorthand like
"Decision 10", "clause-5", "mq.1", "ct.1", "eob.1", "rpe.1",
"post-mq.3", and "Iter 22b.1:" with no in-repo definition the reader
could follow. This commit replaces every such occurrence in the
durable tier the reader is most likely to land on (design/ ledger +
source //! module headers + the central /// public-item rustdoc) with
an inline content phrase plus, where applicable, a Markdown link to
the file that defines the referenced concept.

design/ ledger — 16 files:
  Definition-site headings demoted from "Decision N: <title>" to
  "<title>": authoring-surface, tail-calls, memory-model section in
  rc-uniqueness.md, dual-allocator section, typeclass design,
  effects "pure core + algebraic effects".
  Cross-reference sites: "Decision 1" -> canonical-schema principle
  (data-model); "Decision 3/4" -> effects + scope-boundaries; "Decision
  6" -> authoring-surface; "Decision 8" -> tail-calls; "Decision 9" ->
  rc-uniqueness (dual-allocator); "Decision 10" -> memory-model;
  "Decision 11" -> typeclasses (model). "clause-5" -> body-link
  durability gate. "clause-3" (in language-constraints) ->
  bug-class-reintroduction discriminator. "mq.1/2/3", "ct.1/4",
  "eob.1", "rpe.1" -> the canonical-form rule / the type-driven
  dispatch / the Str carve-out / etc. "post-mq.3" -> "type-driven".

design/contracts/feature-acceptance.md: file-local "clauses 1/2/3"
-> "criteria 1/2/3" (sprachliche Kohärenz mit der File-Überschrift
"Feature-acceptance criterion"); "the clause-3 mechanism" -> "the
bug-class-reintroduction discriminator".

Source //! module headers — 24 files:
  Stripped "Iter X.Y:" prefixes and "(Decision N)" / "(mq.X)" tags
  from spec_drift, uniqueness, reuse_shape, migrate_canonical_types,
  typeclass_22b{2,3,c}, suppress_filter, lift, mono, linearity,
  diagnostic, method_dispatch_pin, method_collision_pin,
  no_per_type_print_ops, mq3_multi_class_e2e, print_mono_body_shape,
  print_no_leak_pin, cli_diag_human_workspace_load_error,
  ct1_check_cli, prose snapshot, unbound_in_instance_method_pin,
  mono_xmod_ctor_pattern, desugar.

Central /// public-item rustdoc:
  ast.rs (full sweep — every "Iter X" + "Decision N" prefix
  reformulated; mode/Type::Fn rustdoc now points at memory-model.md;
  Constraint / SuperclassRef / InstanceDef / ClassDef rustdoc points
  at typeclasses contract).
  diagnostic.rs (all "(Iter X)" / "(mq.X)" tags on diagnostic codes
  removed).
  lib.rs (FORM_A_SPEC rustdoc points at authoring-surface.md
  instead of "Decision 6").
  canonical.rs (type_hash + Float-literal rustdoc).

Still outstanding (for a follow-up commit): ~500 inline `//`
code-body comments with `Iter X.Y` markers across the workspace, and
a handful of `///` rustdoc items in hash_pin / workspace_pin / lift /
mono / suppress_filter test-pin and internal-function bodies. Code
identifiers (test filenames like `mq3_multi_class_e2e.rs`, function
names like `iter18e_drop_iterative_default_preserves_hashes`) stay
verbatim per the user's "code identifiers stay verbatim" rule.

Tests: design_index_pin 5/5 + docs_honesty_pin 5/5; workspace builds
clean; full `cargo test --workspace` previously green (every
`test result: ok` line, no FAILED line).

design/contracts/typeclasses.md

@@ -74,15 +74,18 @@ exactly as for any free function.
 
 ## Cross-module references in synthesised bodies
 
-The unified mono pass (per Decision 11's milestone-23.4 reorganisation)
-synthesises mono symbols for polymorphic free fns and class-method
-instances in the symbol's owner module — e.g. `print__Int` lives in
-`prelude` (because `print` is defined in the prelude), but a
-user-ADT call site `print (MkIntBox 7)` causes synthesis of
-`prelude.print__IntBox` whose body references
-`show_user_adt.show__IntBox` (the user instance lives in the
-user-defining module per Decision 11 coherence). The synthesised body
-crosses a module boundary the source template did not.
+The unified mono pass (see
+[models/typeclasses](../models/typeclasses.md) for the
+resolution/monomorphisation algorithm) synthesises mono symbols for
+polymorphic free fns and class-method instances in the symbol's
+owner module — e.g. `print__Int` lives in `prelude` (because `print`
+is defined in the prelude), but a user-ADT call site
+`print (MkIntBox 7)` causes synthesis of `prelude.print__IntBox`
+whose body references `show_user_adt.show__IntBox` (the user
+instance lives in the user-defining module per the
+orphan-free-coherence rule documented in
+[models/typeclasses](../models/typeclasses.md)). The synthesised
+body crosses a module boundary the source template did not.
 
 Three invariants make this work:
 
@@ -127,7 +130,7 @@ Three invariants make this work:
    workspace registry; if no instance satisfies the residual at the
    unified concrete type, the `NoInstance` diagnostic fires at
    typecheck (correctly), not at codegen (confusingly). Without the
-   residual push, milestone-23-shape negative cases (e.g. `print f`
+   residual push, polymorphic-helper negative cases (e.g. `print f`
    where `f : Int -> Int`) silently typecheck and surface as
    `unknown variable: show` from codegen instead of the right
    typecheck-phase NoInstance Show.
@@ -211,17 +214,17 @@ module.
 - `MissingConstraint` — body's residual constraint is not covered
   by declared (and superclass-expanded) constraints.
 - `NoInstance` — fully concrete constraint has no registry entry.
-  mq.2 adds an optional `candidate_classes` field surfacing the
+  Carries an optional `candidate_classes` field surfacing the
   multi-candidate set when the bare-method dispatch path's filter
   collapses to zero registry survivors.
-- `AmbiguousMethodResolution` (mq.2) — a monomorphic `Term::Var`
+- `AmbiguousMethodResolution` — a monomorphic `Term::Var`
   call site survives both type-driven and constraint-driven filters
   with more than one candidate class. LLM-author writes the explicit
   qualifier form `<module>.<Class>.<method>` to disambiguate.
-- `UnknownClass` (mq.2) — an explicit class qualifier in
+- `UnknownClass` — an explicit class qualifier in
   `Term::Var.name` names a qualified class that is not in the
   workspace's candidate-class index for the method.
-- `class-method-shadowed-by-fn` (mq.3, warning) — a `Term::Var`
+- `class-method-shadowed-by-fn` (warning) — a `Term::Var`
   resolved via fn lookup precedence (locals → caller-module-fn →
   imported-fn) while a class method of the same name also exists
   in the workspace. Fn resolution proceeds; the warning surfaces