feat(aura-engine): reject unwired or double-wired input ports

A graph that leaves an interior input slot unconnected, or wires one slot from more
than one producer, is now a compile-time error instead of a silently-wrong run.
Until now an unwired interior slot was accepted and bootstrapped to an empty column
(harness.rs:137-148), so a forgotten connection ran a deterministic but wrong
backtest; two producers into one slot — ill-formed, since a slot holds one column —
was likewise uncompiled-against.

A single name-free check, `check_ports_connected`, is added to `validate_wiring`
after the existing index/kind checks and before the nested-composite recursion. It
counts coverage of each (interior-node, slot) uniformly across interior edges and
role targets, and rejects zero coverage (new `CompileError::UnconnectedPort`) or >1
(new `CompileError::DoubleWiredPort`). Because `validate_wiring` is called once from
`compile_with_params` and recurses, both the raw `Composite::new` path and the
`GraphBuilder::build()` path inherit it at every nesting level with no builder-side
code (mirrors `check_param_namespace_injective`, the param-side sibling). A
composite's own open input roles (source: None) are coverage providers — the
wired-by-enclosing boundary, the root already guarded by UnboundRootRole — not
consumers. Index-based and name-free: nothing reaches the compilat, so C23 holds.

Supporting fix: the check computes `signature()` on every interior node before the
recursion validates that node's interior, so `derive_signature` and
`interior_slot_kind` are made bounds-total (a placeholder kind for an out-of-range
OutField/target, never a panic; the real fault is still reported by validate_wiring's
guarded OutputPortOutOfRange/BadInteriorIndex). This latent panic was exposed by the
new check, not introduced by it.

Test maintenance (blast radius enumerated empirically, not hand-traced): four
existing tests relied incidentally on under-wiring being accepted — three negative
tests get a covering root role so their intended deep fault still surfaces via the
recursion, and one param-order nesting test is fully wired (param order unchanged).
Six new tests: five raw-surface (unwired, double-wire via edge+role and edge+edge,
nested, open-role boundary) and one builder-surface forgotten-leg (proving the
GraphBuilder inherits the check).

Narrowed scope of #65: the original "promote names to load-bearing wiring keys /
close the exposure-price swap structurally" goal was dropped — #64 already moved
authoring to handles + visible port names, so the residual same-kind swap is a
valid-but-wrong name choice no structural check catches, and a structural fix would
push domain semantics into the domain-free engine (C10/C7). This ships the name-free
half that stands on its own: wiring completeness, which catches forgotten and doubled
connections.

Verified: cargo test --workspace 231 passed / 0 failed; cargo clippy --workspace
--all-targets -- -D warnings clean.

closes #65

docs/design/INDEX.md

@@ -315,6 +315,28 @@ and params and across both graph levels. This does **not** close #21 (a swapped
 same-kind wiring is still only kind-checked) — it makes those slots
 self-documenting; a name-consuming validation is its own future cycle.
 
+**Realization (cycle 0040 — wiring totality: every input slot connected exactly
+once, #65).** The node contract's "the engine provides a window into each input"
+presupposes each input is actually fed; until now an unwired interior input slot was
+accepted and bootstrapped to a silent empty column (`harness.rs`), and two producers
+into one slot — ill-formed, since a slot holds one column — was likewise
+uncompiled-against. Cycle 0040 makes a valid graph **total and single-valued** over
+its interior input slots: `check_ports_connected` (in `validate_wiring`, run at every
+nesting level) requires every interior node's every declared input slot to be covered
+by **exactly one** wiring act — one interior `Edge { to, slot }` or one role
+`Target { node, slot }`, edges and role targets counted uniformly. Zero coverage is
+`CompileError::UnconnectedPort`, more than one is `CompileError::DoubleWiredPort`. A
+composite's **own** input roles (`source: None`) are coverage *providers* — the
+wired-by-enclosing boundary, the root case already guarded by `UnboundRootRole` —
+never consumers, so only interior input slots are subject to the rule. There is **no
+optional-input concept**: every declared input port is required (no shipped node runs
+meaningfully without one; an unwarmed mode-A input is *wired-but-not-yet-valued*, not
+unwired). The check is **index-based and name-free** — it touches no name machinery
+and emits nothing into the compilat, so C23 is untouched (it proves the existing
+raw-index wiring is total and single-valued). Inherited identically by the raw
+`Composite::new` path and the `GraphBuilder::build()` path (both compile via
+`compile_with_params`).
+
 ### C9 — Fractal, acyclic composition
 **Guarantee.** A composite is itself a `Node` that wires a sub-graph and exposes
 one output; signal, combined signal, and (with execution) strategy are all the