audit: M4 cycle close — drift fixes, bench ratified clean

Architect review over 024e865..HEAD (issues #296/#348/#297/#299). Holds
confirmed: zero process::exit in the assembly crate with the milestone
promise pinned in-process; C1/C18 record shapes untouched with guard and
stamp sharing one label constructor; the C30/#348 re-arm transition-safe
with no stale references. Drift resolved in this commit: the C14 contract
now records the context-borne reproduce guard classes (#299), C30 carries
the source-level-identity limit in the contract itself (not only in
build.rs), the guide's exit-class prose no longer names the retired run
verb, C28 durably enumerates the deliberate print residuum, and the
pip_or_refuse doc names reproduce (not 'the CLI shell') as the from_choice
home.

Bench: all 5 fingerprints OK (engine/ingest/campaign_sweep/campaign_heavy/
cli_fixed_cost); metric deltas within load noise on a busy box (loadavg
12 warning), report-only, no baseline moved.

docs/authoring-guide.md

@@ -855,9 +855,9 @@ mismatch, a compile error, a tap-bind content fault (unknown fold/tap,
 duplicate) — are the content of the argv-named file and exit 2 like a usage
 error; only its environment refusals (a tap-trace store write failure)
 exit 1. The no-data family (no local data, no data in the requested window,
-no recorded geometry) belongs to the real-data verbs — `aura run`,
-`reproduce`, the campaign legs — where it likewise exits 1 (#297; the full
-partition lives in [C14](design/contracts/c14-headless-two-faces.md)). `aura
+no recorded geometry) belongs to the real-data paths — `reproduce` and the
+campaign legs — where it likewise exits 1 (#297; the full partition lives
+in [C14](design/contracts/c14-headless-two-faces.md)). `aura
 reproduce`'s identity/pip guard (a stored member's recorded instrument or
 broker/pip label contradicting the source it re-derives against) is
 likewise class 1 on the plain verb — its source is derived from the