audit: #331 cycle close — every authored intake gates the root name, cli_fixed_cost re-pinned

Architect drift review (drift_found) resolved fix-path on all three
items. [high] The sweep/walkforward/mc family builders and
validate_and_register_axes read authored envelope files and
put_blueprint'd them ungated — falsifying the C29 exemption's premise
that the store is populated through gated intakes; all four sites now
gate the root name before the family/axis build (placing the gate
after the build produced a misleading unknown-axis error instead of
the gate refusal — RED-verified), with an e2e pin on the synthetic
sweep route. The decision was gate-the-routes, not weaken-the-prose:
the exemption's premise is the invariant, not a wording choice.
[medium] C24 now states the gate rule as the class it is (the op
intake plus every CLI intake reading an authored envelope from a
file; store read-back exempt, C29). [low] C23 reconciles
names-as-debug-symbols with the render name's one operational role
(trace-directory key — never compilation, identity, or execution
semantics).

Ratify: aura-bench cli_fixed_cost baseline re-pinned
(run_line_fnv 6bb0d796f760d140 -> 9bdbc3acf7b2926a). The moved metric
was caused by the #328 tidy (4474814), which switched single-run
manifest defaults from wrapped to raw axis names after that cycle's
bench rerun had already passed; bbac29d and this cycle's HEAD produce
fingerprint-identical record lines (verified with both binaries on
one scratch project), so this cycle only inherits the stale pin. All
five surfaces fingerprint OK after the re-pin.

refs #331, #328

crates/aura-cli/src/graph_construct.rs

@@ -893,19 +893,31 @@ pub(crate) fn composite_from_any(text: &str, env: &aura_runner::project::Env) ->
 /// function — C29's "registered artifacts are never retroactively
 /// invalidated" stays intact.
 ///
-/// **One deliberate exception:** `aura run <blueprint.json>`'s loaded-blueprint
-/// branch (`dispatch_run`, main.rs) also reads a fresh FILE and reaches the
-/// same unsanitized `traces/<name>/` seam (via `run_signal_r`/`run_measurement`
-/// -> `bind_tap_plan` -> `TraceStore::begin_run`), so it too must gate the root
-/// name — but it does NOT route through this wrapper, because its grammar is
-/// deliberately narrower than `composite_from_any`'s (envelope-only, no
-/// op-script array fallback; a bare `blueprint_from_json` call with its own
-/// load-error prose/hint convention). Routing it through this wrapper would
-/// silently loosen that grammar to also accept op-scripts. It instead calls
-/// [`gate_authored_root_name`] directly, sharing the identical `name_gate` +
-/// `name_gate_fault_prose` primitives this wrapper uses — so the refusal wording
-/// is byte-identical across all five authored-file-intake routes even though
-/// the shape-discrimination step is not shared by `dispatch_run`.
+/// **Deliberate exceptions — direct `gate_authored_root_name` callers
+/// (main.rs).** A handful of fresh-FILE intakes reach the same unsanitized
+/// `traces/<name>/` seam (or `put_blueprint` the loaded envelope straight
+/// into the registry) without going through this wrapper, because each
+/// already parses the document its own way and only needs the shared root-
+/// name gate bolted on, not the shape-discrimination `composite_from_any`
+/// does:
+/// - `aura run <blueprint.json>` (`dispatch_run`): envelope-only grammar (no
+///   op-script fallback), feeds `signal.name()` into
+///   `run_signal_r`/`run_measurement` -> `bind_tap_plan` ->
+///   `TraceStore::begin_run`.
+/// - `validate_and_register_axes` (shared by `generalize`,
+///   `sweep --real`, `walkforward --real`, `mc --real`): `put_blueprint`s
+///   the loaded envelope by topology hash before any of those four verbs
+///   touches an archive.
+/// - `run_blueprint_sweep` / `run_blueprint_walkforward` / `run_blueprint_mc`
+///   (the synthetic, no-`--real` family builders): same `put_blueprint`
+///   reason, on the routes that bypass `validate_and_register_axes`
+///   entirely (#331 cycle-close — these used to plant an ungated envelope
+///   in the store; see each fn's own comment).
+///
+/// All of these share the identical `name_gate` + `name_gate_fault_prose`
+/// primitives this wrapper uses, so the refusal wording is byte-identical
+/// across every authored-file-intake route even though the shape-
+/// discrimination step is not shared by them.
 pub(crate) fn composite_from_authored_text(
     text: &str,
     env: &aura_runner::project::Env,