docs(raw-buf): refresh fixture outcomes; ratify set non-enforcement (refs #7)

- rawbuf_1_score_table / rawbuf_2_running_max: the header OUTCOME blocks
  described the pre-fix breakage (does-not-check / unknown-variable).
  Those defects are fixed (B1 #46, B2 #47, B5); update the comments to
  the current state — both check, build, run to their expected values
  and are leak-clean under AILANG_RC_STATS. The files now serve as
  positive regression examples, not bug repros.

- design/models/0007 §RawBuf: ratify the fieldtest's B4 spec_gap. The
  `own -> own` signature of RawBuf.set is a threading discipline, not
  runtime-enforced single-use; a double-consume of the same owned buffer
  aliases one slab (consistent with every owned value in the language).
  State that single-use is the author's responsibility and full linear
  enforcement is Issue #22 territory.

Surfaced by the raw-buf fieldtest (docs/specs/0058).

design/models/0007-kernel-extensions.md

@@ -405,6 +405,22 @@ The own/borrow signatures *are* the mutation contract. No
 existing memory-model — RC + uniqueness as the canonical
 mutation story.
 
+The `own → own` signature of `RawBuf.set` is a *threading
+discipline*, not runtime-enforced single-use. The mode annotations
+drive the borrow/consume analysis and the in-place-vs-copy codegen
+decision; they do not make a second consume of the same owned
+binder a check-time error. An author who hands the same owned
+buffer to two consuming calls
+(`(let a (RawBuf.set buf 0 1)) (let b (RawBuf.set buf 1 2))`)
+gets two bindings aliasing one slab — the second mutation is
+visible through the first. This is the same non-enforcement that
+holds for every owned value in the language (owned `Str`, owned
+ADTs); `RawBuf`'s in-place `own → own` surface is merely the first
+place the alias produces a *mutated-in-place* surprise rather than
+a benign re-read. Single-use of an owned buffer is the author's
+responsibility. Full linear enforcement, if wanted, is tracked
+separately (Issue #22 territory).
+
 Storage at the LLVM-IR level is type-specialised: the Rust
 intercept registered for `RawBuf` dispatches on the element type
 at each call site and emits the appropriate `getelementptr` /