iter embedding-abi-m1.1 (DONE 7/7): Embedding-ABI M1 — scalar AILang fn callable from C/Rust

Tasks 4-7 on the Boss-Repaired plan, completing the M1 iteration:

- Task 4: check-side export-signature gate — CheckError variants
  ExportNonScalarSignature / ExportHasEffects (codes
  export-non-scalar-signature / export-has-effects), code() arms,
  check_fn gate (params->ret->effects, first-violation-wins,
  unconditional on f.export.is_some()). The clause-3 discriminator
  in code: effectful/non-scalar exports fail to typecheck. 6/6.
- Task 5: codegen Target::StaticLib — Target enum, threaded param,
  @main/MissingEntryMain gated behind Target::Executable, one
  external @<sym> forwarder per export to @ail_<module>_<fn>
  (fn_scalar_sig/llvm_scalar). In-source missing_entry_main_is_error
  byte-unchanged. Lowering pin 2/2.
- Task 6: CLI ail build --emit=staticlib — clap field, Cmd::Build
  branch, build_staticlib (verbatim build_to prefix + has_export
  guard + two-archive clang -c/ar rcs tail) + run_cmd. CLI pin 2/2.
- Task 7: C-host E2E coherent-stop proof (cc links
  libembed_backtest_step.a + libailang_rt.a, backtest_step(0,3)=9 /
  (9,4)=25, s==25, exit 0) + DESIGN.md §"Embedding ABI (M1)"
  (scalar C ABI, provisional until M3). E2E pin 1/1.

Independent Boss verification: E2E 1/1, gate 6/6, full workspace
0 failures, roundtrip_cli + design_schema_drift + spec_drift green,
Invariant 1 holds (no new dep in core/codegen/runtime). 3 behaviour-
neutral plan pseudo-vs-reality concerns in the journal. Default-exe
codegen/runtime path byte-unchanged (check.py firing = tracked-P2
known-noise, audit-adjudicated). INDEX line added.

Completes the M1 iteration (impl). Milestone-close audit + fieldtest
(surface-touching) are the next pipeline steps.

docs/DESIGN.md

@@ -2260,6 +2260,30 @@ overlay shape. The asymmetry between the check side and the mono
 side is by design and is pinned by
 `crates/ailang-check/tests/duplicate_ctor_pin.rs`.
 
+## Embedding ABI (M1)
+
+`ail build --emit=staticlib` compiles a module to a relocatable
+`lib<entry>.a` (program objects only) plus a separate
+`libailang_rt.a` (the RC runtime: `rc.c` + `str.c`), with **no**
+`@main` trampoline and **no** `MissingEntryMain` requirement — a
+kernel module is a library.
+
+Each `fn` carrying `(export "<sym>")` (schema: `FnDef.export`) is
+emitted as an externally-visible C entrypoint `@<sym>` forwarding to
+the internal `@ail_<module>_<fn>`. The symbol is author-chosen and
+decoupled from the `ail_<module>_<def>` mangling so a module/fn
+rename does not move the C symbol.
+
+The M1 ABI is **scalar-only and provisional until M3**: every
+parameter and the return type must be `Int` (lowered `i64`) or
+`Float` (lowered `double`), and the fn's effect set must be empty.
+These are enforced at `ail check` (`export-non-scalar-signature`,
+`export-has-effects`) — an effectful or non-scalar export *fails to
+typecheck*. M1 ships no runtime lifecycle API: the per-thread
+context parameter that M2 threads through every exported call will
+change this C signature; do not treat the M1 signature as frozen.
+The value/record layout freeze is M3.
+
 ## Data model
 
 The on-disk JSON-AST is what the toolchain hashes, typechecks, and