test(0092): run-from-blueprint E2E + bit-identical keystone + demo fixtures

Closes the cycle-1 test coverage for #165. The `aura run <blueprint.json>` CLI
arm itself (the .json dispatch + parse_blueprint_run_args + BlueprintRunArgs)
shipped in ff4a1b3; this adds the coverage that proves it and the in-repo demo
blueprint:

- crates/aura-cli/tests/fixtures/stage1_signal.json — the canonical SMA-cross
  signal (blueprint_to_json of stage1_signal(2,4)); emit_demo_signal_fixture
  (#[ignore]) regenerates it.
- crates/aura-cli/tests/fixtures/unknown_node.json — one type set to "Nope" for
  the fail-clean guard.
- loaded_signal_runs_bit_identical_to_rust_built (the keystone, C1): a signal
  serialized -> loaded via blueprint_from_json -> run is bit-identical to its
  Rust-built twin, incl. topology_hash (64-hex).
- topology_hash_is_stable_and_distinguishes (#158 anchor property).
- cli_run.rs E2E: `aura run <demo>` exits 0 with topology_hash in the manifest;
  an unknown-node blueprint fails clean with UnknownNodeType (the #160 closed-set
  guard at the data-plane face, invariant 9).

Verified end-to-end by actually running the binary: `aura run stage1_signal.json`
-> RunReport with a 64-hex topology_hash, sim-optimal+risk-executor broker, R
metrics; `aura run unknown_node.json` -> UnknownNodeType("Nope"), exit 2. Full
workspace suite green; clippy --all-targets -D warnings clean.

refs #165

crates/aura-cli/tests/cli_run.rs

@@ -317,6 +317,38 @@ fn run_real_nonvetted_symbol_resolves_pip_from_sidecar() {
     );
 }
 
+/// `aura run <blueprint.json>` loads a serialized signal blueprint and runs it
+/// end-to-end (#165): exit 0, a RunReport whose manifest carries the topology_hash.
+#[test]
+fn aura_run_loads_and_runs_a_blueprint_file() {
+    let out = std::process::Command::new(env!("CARGO_BIN_EXE_aura"))
+        .args(["run", "tests/fixtures/stage1_signal.json"])
+        .output()
+        .expect("spawn aura run blueprint");
+    assert_eq!(
+        out.status.code(),
+        Some(0),
+        "exit: {:?} stderr={}",
+        out.status,
+        String::from_utf8_lossy(&out.stderr)
+    );
+    let stdout = String::from_utf8(out.stdout).expect("utf-8");
+    assert!(stdout.contains("\"topology_hash\":\""), "manifest carries the topology hash: {stdout}");
+}
+
+/// A blueprint referencing a node type outside the closed vocabulary fails clean
+/// at load (the #160 closed-set guard at the data-plane face; invariant 9).
+#[test]
+fn aura_run_rejects_an_unknown_node_blueprint() {
+    let out = std::process::Command::new(env!("CARGO_BIN_EXE_aura"))
+        .args(["run", "tests/fixtures/unknown_node.json"])
+        .output()
+        .expect("spawn aura run unknown");
+    assert_ne!(out.status.code(), Some(0), "an unknown node type must fail the run");
+    let stderr = String::from_utf8(out.stderr).expect("utf-8");
+    assert!(stderr.contains("UnknownNodeType"), "names the cause: {stderr}");
+}
+
 #[test]
 fn run_trace_persists_taps_and_plain_run_writes_no_traces() {
     let cwd = temp_cwd("run-trace");