audit(0097): cycle close — IS-refit walk-forward over a loaded blueprint; ledger refreshed (C24/C18); rm ephemeral spec/plan

cycle 0097 tidy (clean). Architect drift review over 485f3c8..HEAD: no code
drift, no debt. Regression: no dedicated script (architect is the sole gate);
its "What holds" is non-empty (design commitments confirmed against the diff):
- Inv. 8 / 9: the cycle touches only crates/aura-cli (main.rs + cli_run.rs +
  the ephemeral spec/plan); walk_forward/WindowRoller/FamilyKind::WalkForward/
  append_family/put_blueprint are read-only reuse, no engine/registry change.
- Inv. 1 / 2: blueprint_walkforward_family reuses the generic walk_forward roller
  (windows disjoint-parallel, across-sim); each IS-sweep/OOS-run sees only its
  window's windowed_sources; IS precedes OOS per window — no look-ahead.
- Reproduce lockstep: the reproduce_family_in WalkForward arm rebuilds each OOS
  slice from stored.manifest.window (before the _ => run_sources fallthrough that
  would rebuild the wrong full-window source); winner params via the shared
  manifest->cells recovery; pinned by the reproduces_bit_identically E2E.
- Structural mirror + panic-safety: one-substitution-deep twin of the hard-wired
  Stage1R arm (select_winner + walk_forward reused, metric sqn_normalized);
  run_blueprint_walkforward follows the content-addressed sibling pattern (no
  ensure_name_free); blueprint_sweep_over returns Result<_,BindError>, a bad axis
  is in-closure exit 2 (never a panic); run_oos_blueprint derives pip internally
  (7 args, no #[allow]).

Ledger: refreshed the C24 realization block (docs/design/INDEX.md) — replaced the
now-false "Walk-forward is deferred (#173, dep #169)" sentence with the "IS-refit
walk-forward shipped (cycle 0097)" note; and extended the C18 reproduction note —
reproduce now spans the third family kind (WalkForward), so all three FamilyKind
variants persist AND reproduce through the one shared topology_hash+put_blueprint
hook.

Milestone: the World/C21 blueprint-data family surface (run/sweep/mc/walkforward/
list-axes/reproduce) is coherent and complete per the architect review — no
structural gap. This audit proves drift-clean; a green end-to-end MILESTONE
FIELDTEST remains the deliberate gate to formally close the World/C21 milestone.
Ephemeral spec/plan git-rm'd per the lifecycle convention.

refs #173

docs/design/INDEX.md

@@ -1316,7 +1316,11 @@ synthetic (deterministic) data; recorded-dataset reproduction rides the DataServ
 (#124). **Cycle 0095 (#170):** `aura reproduce` now also spans `FamilyKind::MonteCarlo` —
 branching on the family kind, it reconstructs each member's seed-driven synthetic walk from
 the recorded `manifest.seed` (the `Sweep` arm unchanged), so an `aura mc` family re-derives
-bit-identically through the same `run_blueprint_member` path.
+bit-identically through the same `run_blueprint_member` path. **Cycle 0097 (#173):** reproduce
+spans the third variant, `FamilyKind::WalkForward` — the same branch rebuilds each OOS member's
+windowed slice from `manifest.window` (winner params via the shared `manifest→cells` recovery),
+so an `aura walkforward` family re-derives bit-identically too. All three family kinds now
+persist *and* reproduce through the one shared `topology_hash`+`put_blueprint` hook.
 
 ### C19 — Bootstrap: blueprint → instance (recursive)
 **Guarantee.** Construction is a distinct phase, recursive at every level. Each
@@ -1897,9 +1901,18 @@ draws disjoint-parallel via the engine `monte_carlo` seam (invariant 1) — and
 `aura reproduce`s bit-identically (C1). MC binds no axis, so it needs a **closed** blueprint
 (the sweep's open/closed distinction inverted); an open one returns a named `Err` (rendered
 exit-2 at the `run_blueprint_mc` boundary, the sweep sibling's contract — no hidden exit in the
-pure builder). **Walk-forward is deferred (#173, dep #169):** a loaded blueprint declares no
-axes to re-fit per window, so it could only be a non-IS-refit windowed eval — which would
-collide with the hard-wired `walkforward` verb's IS-optimizing guarantee. The synthetic-walk DGP
+pure builder). **IS-refit walk-forward shipped (cycle 0097, #173).** `aura walkforward
+<blueprint.json> --axis <name>=<csv> [--select argmax|plateau:mean|plateau:worst]` re-optimizes
+the loaded blueprint's params over the user `--axis` grid (the #169 prefixed names) on each
+24/12/12 IS window, selects the winner by `sqn_normalized` (the hard-wired arm's metric +
+`select_winner` reused verbatim), runs it out-of-sample, and aggregates to a
+`FamilyKind::WalkForward` family — persisted + content-addressed + `aura reproduce` bit-identical
+(the read-side WalkForward branch rebuilds each OOS window from `manifest.window`). One
+substitution deep from the hard-wired stage1-r WF arm (the loaded blueprint via
+`blueprint_axis_probe` replaces the built-in strategy); a bad `--axis` is a clean in-closure
+exit 2, never a panic. This is Arm A (the settled direction): the loaded IS-optimizing form
+honestly carries the `walkforward` name. Reduce-mode members are R-measured (`oos_r` the
+meaningful summary; stitched pip-equity empty, C10). The synthetic-walk DGP
 is the machinery, not trader-grade MC statistics; a real-data block-bootstrap — and the
 `synthetic_walk_sources` `len:60`↔warm-up coupling it retires (a deep-lookback closed blueprint
 warms poorly → silent-vacuous draws today) — ride #172. **Axis-name discovery shipped (cycle