fix(aura-cli): exec --override refuses out-of-domain values and the wrapped form

RED-first fixes for the two field-test bugs on the new flag's blueprint
leg, both formerly exit-101 panics. An out-of-domain override value now
renders the node constructor's own message as a prose refusal, exit 1 —
the single-run bootstrap rides the same catch mechanism the campaign
path's #272 per-cell containment uses (a campaign-leg pin confirms the
identical value was already contained there, exit 3, unchanged). The
retired wrapped axis form refuses before the params zip with a
did-you-mean naming the raw node.param namespace and the discovery verb,
mirroring the campaign leg's existing prose family.

refs #319

crates/aura-cli/src/main.rs

@@ -1124,6 +1124,30 @@ fn exec_blueprint_leg(path: &str, overrides: &[String], tap: &[String], env: &au
         // unmatched path refuses with that same shared prose
         // (`member.rs:768-771`) rather than a second wording.
         let raw_space = blueprint_axis_probe(&doc, env).param_space();
+        // Refuse the retired pre-#328 WRAPPED override form
+        // (`<rootname>.<node>.<param>`) BEFORE `override_paths`: that helper
+        // resolves an override path via `raw_matches_wrapped`, which accepts
+        // an exact wrapped name as well as the raw one (by design, for
+        // resolving an already-validated set) — so a wrapped CLI token
+        // "resolves" there, yet the ORIGINAL token string then misses the
+        // raw-keyed `ov_by_path` lookup below (panic: "override set derived
+        // from these exact overrides"). Mirrors the campaign leg's own
+        // did-you-mean refusal for the same retired form
+        // (`RefFault::AxisNotInParamSpace`, `research_docs.rs`).
+        let raw_bound: std::collections::HashSet<String> =
+            signal.bound_param_space().into_iter().map(|b| b.name).collect();
+        for (p, _) in &ov {
+            if let aura_runner::axes::AxisIntake::WrappedRetired(raw) =
+                aura_runner::axes::classify_axis_intake(p, &raw_space, &raw_bound)
+            {
+                eprintln!(
+                    "aura: axis {p}: names the wrapped param-space form; overrides speak the \
+                     raw node.param namespace — did you mean \"{raw}\"? see \
+                     `aura graph introspect --params <bp>`"
+                );
+                std::process::exit(1);
+            }
+        }
         let axes: Vec<(String, Vec<Scalar>)> = ov.iter().map(|(p, v)| (p.clone(), vec![*v])).collect();
         let paths = override_paths(&axes, &raw_space, &signal).unwrap_or_else(|e| {
             eprintln!("aura: {e}");
@@ -1161,7 +1185,23 @@ fn exec_blueprint_leg(path: &str, overrides: &[String], tap: &[String], env: &au
             })
             .collect();
         let signal = reopen_all(signal, &paths);
-        let report = run_signal_r(signal, &params, RunData::Synthetic, 0, env, tap_plan);
+        // An out-of-domain override value fails a node's own domain check at
+        // bootstrap (e.g. `Sma::new`'s `assert!`, or a negative length
+        // overflowing the ring-buffer allocation) — a constructor panic, not
+        // a `Result`. The campaign leg contains the identical value as a
+        // #272 per-cell fault; this single-run leg has no cell containment,
+        // so catch the same panic at this dispatch boundary via the shared
+        // `catch_member_panic` recipe (`aura_campaign::exec`'s own
+        // `SilencedPanic` + `catch_unwind`) and render it as a runtime-class
+        // refusal (exit 1, C14 partition) instead of an uncaught exit 101 —
+        // the input was well-formed argv; the value is what the node refuses.
+        let report = aura_campaign::catch_member_panic(|| {
+            run_signal_r(signal, &params, RunData::Synthetic, 0, env, tap_plan)
+        })
+        .unwrap_or_else(|msg| {
+            eprintln!("aura: {msg}");
+            std::process::exit(1);
+        });
         println!("{}", report.to_json());
     } else if has_tap {
         if !overrides.is_empty() {