feat(registry,cli): referential tier requires full open-param coverage; bind refusal speaks the raw namespace

validate == runnable (fieldtest 0107 F7): validate_campaign_refs now
checks the reverse direction — every open param of the resolved
strategy must be bound by some campaign axis — emitting the new
RefFault::ParamNotCovered { strategy, param } with the RAW
param_space() path; ref_fault_prose phrases it ('open param "X" is
bound by no campaign axis'). The executor's every-open-knob-required
rule is thereby mirrored at validate time, and campaign run's
referential gate catches an uncovered knob before any member binds.
The e2e fixture that legitimately under-covered (fast only) gains the
slow.length axis.

Second half, RED-first: the member-bind refusal no longer leaks the
wrapped bind-time path — it names the raw campaign-axis namespace with
the wrapped path as a parenthetical ('open param "threshold" ...
(wrapped path: sma.threshold)').

RED evidence: E0599 on the pinned ParamNotCovered test (tdd-author
handoff), then the flipped bind_axes prose pin observed failing on the
wrapped form.

Gates: workspace 988/0, clippy -D warnings clean.

closes #203

crates/aura-cli/src/research_docs.rs

@@ -263,6 +263,9 @@ pub(crate) fn ref_fault_prose(f: &RefFault) -> String {
         RefFault::AxisKindMismatch { strategy, axis } => {
             format!("strategy {strategy}: axis \"{axis}\" declares a kind that is not the param's kind")
         }
+        RefFault::ParamNotCovered { strategy, param } => {
+            format!("strategy {strategy}: open param \"{param}\" is bound by no campaign axis")
+        }
     }
 }