feat(registry,cli): referential tier requires full open-param coverage; bind refusal speaks the raw namespace

validate == runnable (fieldtest 0107 F7): validate_campaign_refs now
checks the reverse direction — every open param of the resolved
strategy must be bound by some campaign axis — emitting the new
RefFault::ParamNotCovered { strategy, param } with the RAW
param_space() path; ref_fault_prose phrases it ('open param "X" is
bound by no campaign axis'). The executor's every-open-knob-required
rule is thereby mirrored at validate time, and campaign run's
referential gate catches an uncovered knob before any member binds.
The e2e fixture that legitimately under-covered (fast only) gains the
slow.length axis.

Second half, RED-first: the member-bind refusal no longer leaks the
wrapped bind-time path — it names the raw campaign-axis namespace with
the wrapped path as a parenthetical ('open param "threshold" ...
(wrapped path: sma.threshold)').

RED evidence: E0599 on the pinned ParamNotCovered test (tdd-author
handoff), then the flipped bind_axes prose pin observed failing on the
wrapped form.

Gates: workspace 988/0, clippy -D warnings clean.

closes #203

crates/aura-cli/tests/research_docs.rs

@@ -327,7 +327,8 @@ fn campaign_validate_in_project_reports_referential_tier_end_to_end() {
   "name": "ref-check",
   "data": {{ "instruments": ["GER40"], "windows": [ {{ "from_ms": 1, "to_ms": 2 }} ] }},
   "strategies": [ {{ "ref": {{ "content_id": "{bp}" }},
-                    "axes": {{ "fast.length": {{ "kind": "I64", "values": [2] }} }} }} ],
+                    "axes": {{ "fast.length": {{ "kind": "I64", "values": [2] }},
+                              "slow.length": {{ "kind": "I64", "values": [6] }} }} }} ],
   "process": {{ "ref": {{ "content_id": "{proc}" }} }},
   "seed": 1,
   "presentation": {{ "persist_taps": [], "emit": ["family_table"] }}