feat(check): reject borrow-returns at the signature (#55, 0121 task 1)

`(ret (borrow T))` is now a check error (CheckError::BorrowReturnNotPermitted,
code `borrow-return-not-permitted`), fired on the fn signature before
body dataflow. Borrow-returns are refcount-invisible and can outlive
their source; re-enabling them needs the escape/liveness axis, which is
out of scope (spec 0062). The diagnostic names that gap as an honest
"not yet".

The check_fn signature destructure now also binds `ret_mode` (param_modes
stays under `..`; the borrow-over-value reject that reads it is folded
into the cutover, task 4). RED-first: examples/borrow_return_reject.ail
checked clean (exit 0) before the reject landed, exits 1 after. New
CLI-boundary E2E pin crates/ail/tests/mode_signature_rejects.rs, modelled
on raw_buf_new_type_arg_pin.rs. Additive — ParamMode::Implicit still
present; full workspace suite green, bench/check.py 0 regressed.

refs #55

crates/ail/tests/mode_signature_rejects.rs

@@ -0,0 +1,27 @@
+//! Signature-level mode rejects added by spec 0062: borrow-return
+//! (`(ret (borrow T))`) and borrow-over-value (`(borrow value-type)`).
+//! CLI-boundary E2E (the project's reject-pin pattern): the diagnostic
+//! is the observable exit behaviour of `ail check`.
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+fn repo_root() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).parent().unwrap().parent().unwrap().to_path_buf()
+}
+
+fn check_rejects_with(fixture: &str, code: &str) {
+    let path = repo_root().join("examples").join(fixture);
+    let out = Command::new(env!("CARGO_BIN_EXE_ail"))
+        .arg("check").arg(&path).output().expect("ail check spawn");
+    assert!(!out.status.success(),
+        "expected `ail check {fixture}` to REJECT, but it passed: stdout={}",
+        String::from_utf8_lossy(&out.stdout));
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    assert!(stderr.contains(code), "expected code `{code}`, got: {stderr}");
+}
+
+/// `(ret (borrow T))` is rejected with code `borrow-return-not-permitted`.
+#[test]
+fn borrow_return_is_rejected() {
+    check_rejects_with("borrow_return_reject.ail", "borrow-return-not-permitted");
+}