audit: #331 cycle close — every authored intake gates the root name, cli_fixed_cost re-pinned

Architect drift review (drift_found) resolved fix-path on all three
items. [high] The sweep/walkforward/mc family builders and
validate_and_register_axes read authored envelope files and
put_blueprint'd them ungated — falsifying the C29 exemption's premise
that the store is populated through gated intakes; all four sites now
gate the root name before the family/axis build (placing the gate
after the build produced a misleading unknown-axis error instead of
the gate refusal — RED-verified), with an e2e pin on the synthetic
sweep route. The decision was gate-the-routes, not weaken-the-prose:
the exemption's premise is the invariant, not a wording choice.
[medium] C24 now states the gate rule as the class it is (the op
intake plus every CLI intake reading an authored envelope from a
file; store read-back exempt, C29). [low] C23 reconciles
names-as-debug-symbols with the render name's one operational role
(trace-directory key — never compilation, identity, or execution
semantics).

Ratify: aura-bench cli_fixed_cost baseline re-pinned
(run_line_fnv 6bb0d796f760d140 -> 9bdbc3acf7b2926a). The moved metric
was caused by the #328 tidy (4474814), which switched single-run
manifest defaults from wrapped to raw axis names after that cycle's
bench rerun had already passed; bbac29d and this cycle's HEAD produce
fingerprint-identical record lines (verified with both binaries on
one scratch project), so this cycle only inherits the stale pin. All
five surfaces fingerprint OK after the re-pin.

refs #331, #328

crates/aura-cli/tests/cli_run.rs

@@ -2449,6 +2449,53 @@ fn aura_walkforward_synthetic_blueprint_refuses_a_wrapped_form_axis_name() {
     let _ = std::fs::remove_dir_all(&dir);
 }
 
+/// Property (#331 cycle-close, high finding): the SYNTHETIC (no `--real`)
+/// blueprint sweep reads a fresh-FILE envelope and `put_blueprint`s it into
+/// the registry unconditionally (`run_blueprint_sweep`, keyed by the
+/// family's shared topology hash) — before this fix that write was UNGATED,
+/// so `aura sweep bad.json` could plant a shape-violating root name
+/// (`"../x"`) in the store, breaking the C29 exemption's premise that "the
+/// store is populated through the gated intakes" (`composite_from_any`'s
+/// doc comment). A hand-edited envelope whose root name violates
+/// `name_gate` must now refuse with the shared `name_gate_fault_prose`
+/// wording (byte-identical to `register`/`run`/etc.) at the site's usual
+/// exit code (2, matching every other blueprint-load refusal in this
+/// function), and nothing must land in `runs/blueprints`.
+#[test]
+fn aura_sweep_synthetic_blueprint_refuses_a_hand_crafted_envelope_with_a_bad_root_name() {
+    let dir = temp_cwd("sweep_synthetic_bad_root_name_refusal");
+    let fixture_text = std::fs::read_to_string(format!("{}/examples/r_sma.json", env!("CARGO_MANIFEST_DIR")))
+        .expect("read r_sma.json fixture");
+    let bad = fixture_text.replacen("\"name\":\"sma_signal\"", "\"name\":\"../x\"", 1);
+    assert!(bad.contains("\"name\":\"../x\""), "the root-name replace landed: {bad}");
+    let file = dir.join("bad-root-name.json");
+    std::fs::write(&file, &bad).expect("write envelope fixture");
+
+    let out = Command::new(BIN)
+        .args(["sweep", file.to_str().unwrap(), "--axis", "fast.length=2,4"])
+        .current_dir(&dir)
+        .output()
+        .expect("spawn aura sweep (synthetic, bad root name)");
+    assert_eq!(
+        out.status.code(),
+        Some(2),
+        "a shape-violating root name must be refused, not registered: status={:?} stderr={}",
+        out.status,
+        String::from_utf8_lossy(&out.stderr)
+    );
+    let stderr = String::from_utf8_lossy(&out.stderr).into_owned();
+    assert!(
+        stderr.contains("blueprint name \"../x\" is invalid") && stderr.contains("must not contain '/' or '\\'"),
+        "names the offending root name with the shared gate prose: {stderr}"
+    );
+    assert!(out.stdout.is_empty(), "a refused root name must not print a member line: {out:?}");
+    assert!(
+        !dir.join("runs").exists(),
+        "a refused root name must leave no store — nothing may land in runs/blueprints"
+    );
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 /// Property (#247, #328 render-seam echo): every sweep-verb boundary
 /// `BindError` renders as prose in the same register as its unknown-axis
 /// sibling (`aura: axis <name>: names no param of this blueprint … — see