feat(aura-cli): --tap TAP=FOLD fold-subscription selector on aura run

Decide #310's data-authorability fork as (b), split by run-mode
authority: selecting a Named fold subscription is data-reachable on the
one-shot run path; adding a fold stays a Rust entry (role 2, C25).
`aura run` gains a repeatable --tap TAP=FOLD selector feeding the
existing TapPlan seam: no flag keeps the record-all default; any flag
replaces the plan entirely (unlisted taps stay unbound — C27 inert,
non-error). Validation stays in bind_tap_plan (roster-enumerating label
refusal, typed UndeclaredTap, both before store I/O); parse-level
refusals (malformed pair, duplicate tap) exit 2 via the verb's usage
convention.

Rejected alternatives (minuted on #310 with the skeptic-pass
rationale): an op-script/blueprint carrier (C27 forbids recording
policy in the serialized fragment); ratifying Rust-only (softens a
designed-in promise with effort as the only rationale). The
campaign/document carrier and the persist_taps/declared-tap namespace
reconciliation are deferred to the Measurement-reachable milestone
(#312/#327, minuted on #312).

Ledger: C27 Current state records the boundary; the superseded sentence
moved verbatim to the new c27-declared-taps.history.md sidecar; the
glossary tap-plan paragraph updated, fixing the pre-existing inaccuracy
that named `aura measure` a record-all-passing verb (it is the post-hoc
IC analysis and constructs no tap plan).

Verification: 5 new unit tests (parse branches), 5 new binary-level
selector tests incl. a byte-identity pin of an explicit all-record plan
vs the record-all default (C1), 1 measurement-arm test; full workspace
suite green; clippy -D warnings clean. Independent opus diff review:
approved, no Important/Minor findings (nits: inert-arm generic refusal,
a=b=c falling to the roster refusal — accepted as-is).

closes #310

docs/design/contracts/c27-declared-taps.history.md

@@ -0,0 +1,11 @@
+# C27 — Declared taps: named measurement points bind sinks run-mode-aware: history
+
+> FROZEN HISTORICAL RECORD. Each block below was true as of its cycle/date stamp
+> and may be superseded; this file is NOT current truth and NOT a grounding
+> surface. Current contract: [c27-declared-taps.md](c27-declared-taps.md).
+
+**Current-state tap-plan sentence (2026-07-21, #283; superseded 2026-07-24 by
+the #310 `--tap` selector):** "…and the shared `bind_tap_plan`/`BoundTaps`
+pair called by both declared-tap entry points, `run_signal_r`
+(`aura-runner::member`) and `run_measurement` (`aura-runner::measure`); both
+CLI verbs pass a record-all plan."

docs/design/contracts/c27-declared-taps.md

@@ -68,7 +68,18 @@ and the roster-enumerating refusal — plus a scalar-typed param schema; all cor
 entries are param-less today, the seam ships in every entry's build signature),
 and the shared `bind_tap_plan`/`BoundTaps` pair called by both declared-tap entry
 points, `run_signal_r` (`aura-runner::member`) and `run_measurement`
-(`aura-runner::measure`); both CLI verbs pass a record-all plan. The `record`
+(`aura-runner::measure`) — both arms of the single CLI verb `aura run`, whose
+repeatable `--tap TAP=FOLD` selector (#310) makes the `Named` selection
+data-reachable: no flag keeps the record-all default, any flag replaces the
+plan entirely (unlisted taps stay unbound/inert). The boundary is thereby
+fixed in place: *selecting* a subscription is run-mode authority, exercised
+by the run-mode owner — on the one-shot path the CLI invocation itself, a
+projection exercising this contract's authority, not a second home for
+intent under [C25](c25-role-model.md) — while *adding* a fold stays a Rust
+entry (role 2). The campaign/document carrier, and the reconciliation of the
+presentation-tap namespace (`persist_taps`) with declared taps it requires,
+is deferred to the Measurement-reachable milestone (#312/#327, minuted on
+#312). The `record`
 consumer (`aura-runner::tap_recorder::TapRecorder`) holds the trace store's
 streaming writer in-graph — `initialize` opens (deferred acquisition), `eval`
 appends `(Timestamp, Cell)` (zero per-cycle heap, #77), `finalize` reports