feat(aura-cli, aura-runner): exec routing-seam refusals + by-name unbound-role prose

Harvest sweep, batch 2 of 6.

- exec's file-target classification is now a four-way shape peek
  (campaign / blueprint / op-script / wrong-kind): a valid-JSON op-script
  array refuses at the routing seam with a build-first pointer ('aura
  graph build') instead of the blueprint leg's false 'not valid JSON'
  claim, and a kind-bearing non-campaign document names the found kind
  plus exec's two executable classes. Exit-code classes unchanged
  (op-script usage-class 2, wrong-kind runtime-class 1).
- the bare-tap measurement leg renders CompileError::UnboundRootRole by
  the signal's own root-role NAME (captured pre-consumption), retiring
  the raw Debug-form leak; every other variant keeps the total fallback.

refs #342
refs #339

crates/aura-cli/tests/graph_construct.rs

@@ -2312,10 +2312,9 @@ fn graph_build_accepts_an_open_input_pattern() {
 /// through `wrap_r` (an existing, unrelated nesting mechanism unaffected by
 /// this cycle), so a bare-tap (no-`bias`) pattern is used here: its
 /// `run_measurement` path compiles the signal directly, hitting
-/// `CompileError::UnboundRootRole` at bootstrap — via the EXISTING `{e:?}`
-/// Debug rendering (a raw index, not a role name); a name mapping there is
-/// left for a follow-up (out of this cycle's scope, per the plan's own
-/// escape hatch), so this pins the existing form.
+/// `CompileError::UnboundRootRole` at bootstrap — rendered by role NAME
+/// (#342 item 3), not the raw flat index the earlier form left as a
+/// follow-up.
 #[test]
 fn running_an_open_blueprint_refuses_at_bootstrap() {
     let doc = r#"[
@@ -2333,7 +2332,8 @@ fn running_an_open_blueprint_refuses_at_bootstrap() {
     assert_eq!(code, Some(1), "an open blueprint refuses standalone at bootstrap, not finish: {stdout} {stderr}");
     assert!(stdout.is_empty(), "no report emitted on a bootstrap refusal: {stdout}");
     assert!(
-        stderr.contains("UnboundRootRole"),
-        "the runnability gate (compile), unchanged, names the fault: {stderr}"
+        stderr.contains("root role \"price\" is unbound"),
+        "the runnability gate (compile), unchanged, now names the role, not a raw index: {stderr}"
     );
+    assert!(!stderr.contains("UnboundRootRole"), "Debug leak: {stderr}");
 }