iter form-a.tidy: form_a.md class/instance/constraints + 3 documentary drift items

Six-task post-fieldtest documentary tidy. No production-code behaviour
changes; 559 tests green at every per-task gate.

T1-T3: form_a.md additions
- §Definitions intro "Three kinds" -> "Five kinds".
- New `### Class — (class ...)` subsection: EBNF carries optional
  superclass (0 or 1 per ClassDef.superclass schema), method
  signatures with optional defaults; anchored to
  examples/test_22c_user_class_e2e.ail (ok 24/2).
- New `### Instance — (instance ...)` subsection: EBNF carries the
  (method NAME (body LAM-TERM))* shape; canonical-form CLASS-REF
  rule explicitly stated (bare same-module / qualified cross-module);
  two examples — same-module abbreviated from
  mq3_class_eq_vs_fn_eq_classmod.ail and cross-module qualified
  from show_user_adt.ail; bare-cross-module-class-ref diagnostic
  named inline.
- §Types `(forall ...)` line extended with optional `(constraints
  (constraint CLASS-REF TYPE)+)?` clause; explanatory paragraph
  added with no-instance diagnostic anchor; fifth example added
  to the Examples block anchored to cmp_max_smoke.ail.

T4: docs/specs/2026-05-13-form-a-default-authoring.md "seven
carve-outs" → "eight carve-outs" at 6 sites contradicting the
§C4(b) compile-time-embed amendment (commit 9fcda8b). Sites:
preamble line 11, §C1 line 170, §C2 line 191, §C3 line 218,
§"Data flow" lines 363 + 374. Post-edit grep returns 4 surviving
"seven" lines (233, 238, 463, 469), all correctly §C4(a)-scope
or arithmetic/future-state.

T5: crates/ailang-core/src/hash.rs:50-57 — delete empty
`#[cfg(test)] mod tests {}` placeholder + 6-line relocation
comment. Tests live in crates/ailang-core/tests/hash_pin.rs
since form-a.1 T5; placeholder served no purpose. hash_pin.rs
still 10/10 passing.

T6: crates/ailang-surface/tests/round_trip.rs — module-level
`//!` and inner `///` docstrings rewritten to the post-T10
four-property framing (parse-determinism / idempotency /
CLI-pipeline-idempotency / carve-out-anchor) instead of the
retired Direction-1/Direction-2 language. Sibling-crate
breadcrumbs added pointing at the other two enforcement points
(roundtrip_cli.rs, carve_out_inventory.rs).

Drift item B2 (audit-form-a "plan file two sites") dropped per
recon verification: docs/plans/2026-05-13-iter-form-a.1.md
contains zero defective "seven" sites; all four hits are
internally scoped to §C4(a), arithmetic, or future-state.
Decision recorded in the journal.

Closes 2 of 3 fieldtest-form-a spec_gap findings (#2 form_a.md
typeclass surface + #3 form_a.md class-qualifier rule for
instance) and 3 of 4 audit-form-a drift items.

docs/specs/2026-05-13-form-a-default-authoring.md

@@ -8,7 +8,7 @@
 
 Make Form A (`.ail`) the sole authoring surface for every program in
 the working tree. After this milestone, the only `.ail.json` files
-that remain in the repository are seven specific negative-test
+that remain in the repository are eight specific negative-test
 fixtures whose subject matter cannot be expressed in Form A by
 construction. Every other `.ail.json` is rendered to its `.ail`
 sibling via `ail render`, and the now-redundant `.ail.json` is
@@ -167,7 +167,7 @@ not the projection's relation to the AST.
 ### C1. Migration script
 
 A one-shot Bash script `scripts/migrate-to-form-a.sh` (new file)
-walks `examples/*.ail.json`, skips the seven carve-outs (named
+walks `examples/*.ail.json`, skips the eight carve-outs (named
 explicitly in the script body), invokes `ail render` to produce
 the sibling `.ail`, and `rm`s the JSON counterpart. The script is
 idempotent (re-running on a partially migrated tree is a no-op for
@@ -188,7 +188,7 @@ The refactor is mechanical but spans three classes of consumer:
    `examples/<stem>.ail.json` with `fs::read_to_string` and
    passes the bytes to `Module::from_json` or the workspace
    loader. The refactor reads `examples/<stem>.ail` and parses via
-   `ailang_surface::parse_module_from_str`. The seven carve-outs
+   `ailang_surface::parse_module_from_str`. The eight carve-outs
    continue to use the `.ail.json` path (they have no `.ail` form
    by construction).
 3. **Bench drivers** (`bench/*.py`, `bench/run.sh`). The drivers
@@ -215,7 +215,7 @@ so the invariant restates as:
   | ail parse` (one round) is byte-identical to direct
   `ail parse` of the source `.ail`. Pins the user-facing CLI
   against drift internal tests cannot see.
-- **Carve-out anchor.** The seven `.ail.json`-only fixtures are
+- **Carve-out anchor.** The eight `.ail.json`-only fixtures are
   negative-tests (load-time / typecheck-time rejection); they
   participate only in the existing rejection-shape tests, not in
   the roundtrip gate. Their presence is the *only* surviving
@@ -360,7 +360,7 @@ author writes:          examples/<name>.ail             (every program)
                               v
                    Module value -> typecheck, codegen, ...
 
-except for the seven carve-outs:
+except for the eight carve-outs:
                         examples/<carve-out>.ail.json
                               |
                               v
@@ -371,7 +371,7 @@ Cross-module imports continue to use module names, not file paths;
 the workspace loader walks `examples/*` and accepts either extension
 for any module it loads. Since the bulk of the corpus is single-
 extension post-migration, the loader's extension-dispatch is exercised
-only by the seven carve-outs (and by any test that explicitly mixes
+only by the eight carve-outs (and by any test that explicitly mixes
 the two forms for migration testing).
 
 ## Error handling