audit: shell-boundary cycle close — drift resolved in-commit

Cycle-close audit (architect: drift_found; design core clean). What
holds, architect-confirmed with the guard run and the diff read in
full: the shell boundary is real and enforced (full-workspace
c28_layering incl. completeness + shell-content checks, acceptance
grep clean — no member-run symbol left under crates/aura-cli/src);
aura-campaign keeps zero production dependency on the runner; the IC
move is verbatim against the anchor; the new library-only E2E pins C1
(two independent runners, byte-identical RunReport).

Drift items, all resolved as fixes in this commit:
- design ledger: the C28 status sentence "No crate exists yet for
  measurement" contradicted this cycle's own phase-3 done line — now
  records aura-measurement as seeded (#295), execution still unbuilt.
- the #147 registry-dispatch acceptance tests (IC deflation null,
  seeded determinism, cross-vocabulary refusal) were pure library
  properties stranded in the shell's test module — relocated to
  aura-measurement/tests/registry_dispatch.rs (engine/registry as
  dev-only, layering-exempt edges), per the cycle's own tests-move-
  with-their-module rule.
- aura-runner's direct production edge on the external data-server
  tree was structurally invisible (the direction table checks aura-*
  keys only) and unrecorded — the C28 assembly prose now names it, and
  a new c28_layering test pins the external tree's entry points to
  exactly {aura-ingest, aura-runner, aura-cli}.
- the C28 shell prose named three buckets that did not cover two real
  shell residents — it now names the op-script construction front-end
  (translation) and the `aura new` scaffolder (authoring-tooling,
  shell-resident like rendering until a second consumer wants it).

Deliberately deferred, tracker homes exist (not drift): #297
(process::exit sites in aura-runner's single-run verb paths), #294
(IC duplicate-timestamp semantics), #288-era rustdoc unresolved-link
warnings in aura-std/aura-backtest (pre-existing byte-identically at
the anchor).

No regression scripts are configured (the bench is report-only); the
architect review is the gate. Verification: cargo test --workspace
green (1474 passed, 0 failed) incl. the relocated registry-dispatch
tests and the new data-server guard; clippy --workspace --all-targets
-D warnings clean.

refs #295

docs/design/INDEX.md

@@ -2648,11 +2648,19 @@ composes the rungs into the canonical member-run recipe — harness assembly,
 input binding (C26), the C1-load-bearing param↔config translators, and the
 shipped default `MemberRunner` — importing the ladder rungs, `aura-composites`,
 `aura-ingest`, and the process column, and imported only by the shell and by
-downstream World programs. The **shell** (the `aura` CLI) imports everything,
+downstream World programs. It also carries a direct production dependency on
+the external `data-server` tree (inherited from the shell with the recipe: the
+runner constructs archive servers itself). The external tree therefore enters
+the workspace at the ingestion edge (`aura-ingest`, External components), the
+assembly position (`aura-runner`), and the shell (which imports everything by
+definition) — and at no ladder or column crate beyond those; the
+`c28_layering` guard pins the exact set. The **shell** (the `aura` CLI) imports everything,
 is imported by nothing, exports nothing, and holds no domain logic:
-argv/dispatch, argv→document translation, and presentation only (rendering
-stays in the shell until the C22 web face provides its second consumer — #295
-deferral).
+argv/dispatch, argv→document translation (including the op-script construction
+front-end, `graph_construct`), presentation, and the `aura new` project
+scaffolder (authoring-tooling template emission — shell-resident, like
+rendering, until a second consumer wants it). Rendering stays in the shell
+until the C22 web face provides its second consumer (#295 deferral).
 
 **Import rule.** An outer ladder layer may import inner layers, never the
 reverse; *measurement* and *strategy* are siblings (no import either way);
@@ -2738,10 +2746,11 @@ cleanly by layer, so the layering is realized only partially:
   interweave is resolved (phase 5, #291): the backtest reductions live in
   `aura-backtest::metrics` beside their `position_management` producer, and
   `aura-analysis` is reduced to domain-free statistics + selection provenance
-  (`[dependencies]` = serde only). No crate exists yet for *measurement* (its run
-  verb is the additive shape dispatch, #286) or *execution* (unbuilt — the C10/C13
-  edge only). Under this model the `aura-registry → aura-research` edge is
-  column-internal and legal.
+  (`[dependencies]` = serde only). The *measurement* rung is seeded (#295):
+  `aura-measurement` carries the IC vocabulary + reduction (its run verb remains
+  the additive shape dispatch, #286). No crate exists yet for *execution*
+  (unbuilt — the C10/C13 edge only). Under this model the
+  `aura-registry → aura-research` edge is column-internal and legal.
 - Phased realization (each independently shippable; behaviour byte-identical
   except the purely additive shape dispatch): (1) this contract; (2) cut the
   engine's backtest-metrics edge via `RunReport<M>` — **done** (#292: