feat(aura-cli): self-identifying RunManifest.commit via build.rs git capture

RunManifest.commit read option_env!("AURA_COMMIT").unwrap_or("unknown"),
so a normal build's manifest identity field was a bare placeholder --
C8's audit trail (this run = this commit) had nothing to point back at
once runs are archived (C18 registry).

Add crates/aura-cli/build.rs: at compile time it shells out to the `git`
already in PATH -- `rev-parse HEAD`, plus a `-dirty` suffix when
`status --porcelain` is non-empty -- and emits
`cargo:rustc-env=AURA_COMMIT=<sha>`. The existing option_env! read is
untouched and now picks it up. Chose shelling to git over a libgit crate
to keep the zero-external-dependency commitment (C14/C18); the firewall
crate is aura-ingest, and a build-time process call adds no runtime dep.
No-git case (packaged source tree, no .git): build.rs returns early and
swallows git errors, leaving AURA_COMMIT unset so "unknown" still holds.

Staleness guard: build.rs emits rerun-if-changed on .git/HEAD and
.git/logs/HEAD (logs/HEAD grows on every HEAD move incl. branch switch),
so the captured sha is rebuilt when HEAD moves rather than going stale.
Determinism (C1) is intact: AURA_COMMIT is fixed at compile time, so two
runs of one build still produce byte-identical manifests.

Two tests that pinned the old "unknown" placeholder are relaxed to the
new structural contract (not scope creep -- they were the old contract):
the cli_run.rs JSON-shape prefix no longer pins the commit value, and
the main.rs unit test asserts commit is non-empty and stable across runs
instead of equal to "unknown". The headline contract (manifest.commit
contains the real HEAD sha) is pinned by run_manifest_commit_carries_
real_git_head (4552d0c). Verified: cargo test -p aura-cli green (5),
clippy --all-targets -D warnings clean.

closes #15

crates/aura-cli/tests/cli_run.rs

@@ -18,7 +18,10 @@ fn run_prints_json_and_exits_zero() {
     let line = stdout.trim_end();
 
     // canonical cycle-0009 JSON shape: nested manifest + metrics, stable keys.
-    assert!(line.starts_with("{\"manifest\":{\"commit\":\"unknown\","), "got: {line}");
+    // The manifest leads with a `commit` field; its value is the build's git
+    // identity (asserted by `run_manifest_commit_carries_real_git_head`), so
+    // this shape check pins only the surrounding structure, not the value.
+    assert!(line.starts_with("{\"manifest\":{\"commit\":\""), "got: {line}");
     assert!(line.contains("\"broker\":\"sim-optimal(pip_size=0.0001)\""), "got: {line}");
     assert!(line.contains("\"window\":[1,7]"), "got: {line}");
     assert!(line.contains("\"metrics\":{\"total_pips\":"), "got: {line}");