fix(bench): make the cli_fixed_cost fingerprint invariant across build commits

Caught by the harness itself on its first post-commit run: the aura run
record line embeds manifest.commit — the binary's compile-time build sha
(crates/aura-cli/build.rs, the invariant-8 audit trail) — so hashing the raw
line flipped the fingerprint on every rebuild at a new commit and reported a
phantom correctness change (exit 1) at each cycle close. The rebase onto the
#191 main exposed it; nothing in #191 touched the record.

RED-first: run_line_fingerprint_is_invariant_across_build_commits pins the
symptom (two lines differing only in manifest.commit must hash identically);
the fix extracts run_line_fingerprint, which parses the line, blanks that
one volatile field, re-serializes (serde_json maps are sorted, so the bytes
are deterministic), and hashes. A missing manifest.commit is a hard error,
so a future record-schema move fails loudly instead of silently passing.
The cli_fixed_cost baseline is re-pinned under the new definition — ratify:
the fingerprint DEFINITION changed (provenance excluded, results still
covered, pinned by run_line_fingerprint_still_detects_result_changes); no
measured behaviour of aura moved.

refs #251

crates/aura-bench/baselines/cli_fixed_cost.json

@@ -1,16 +1,16 @@
 {
   "surface": "cli_fixed_cost",
   "metrics": {
-    "help_ms": 1.53201,
-    "run_ms": 3.37904
+    "help_ms": 1.5094509999999999,
+    "run_ms": 3.679743
   },
-  "fingerprint": "run_line_fnv=ef791827583f616b",
+  "fingerprint": "run_line_fnv=792dc4434f8e3dee",
   "reps": 3,
   "host": {
     "hostname": "Raki",
     "nproc": 24
   },
   "profile": "release",
-  "commit": "d62dede",
+  "commit": "13d8500",
   "date": "2026-07-17"
 }