audit: cycle 0033 (#54) — refresh stale JSON-writer cross-refs after to_json→serde

Architect drift review over 065cf1d..HEAD. Code + contracts hold; the only drift
was documentation cross-references made stale by retiring RunReport's hand-rolled
to_json.

Contracts (all hold):
- C14: to_json still emits canonical, flat, deterministic JSON — now serde-produced.
  model_to_json (the graph-model JSON) stays hand-rolled and was correctly untouched.
- C16: serde_json dev-dep → normal-dep in aura-engine is squarely sanctioned by the
  amended per-case policy (INDEX.md:576-583) — a vetted standard crate used where it
  does the job (incl. the frozen bot), removing a hand-rolled writer. No gap.
- C1: report types have no HashMap; serde is declaration-order/deterministic; the
  r1.to_json()==r2.to_json() asserts and the new to_json_equals_serde_disk_shape pin
  stay green.

Regression: none configured (profile regression: []) — no-op; architect is the gate.

Resolution — fix (3 prose cross-refs, fixed inline this commit):
- graph_model.rs:5 (module doc) — claimed the model JSON is in the "RunReport::to_json
  house style (no serde)"; to_json is serde now. Reframed: the model JSON is hand-rolled
  (no serde), and is the engine's last hand-rolled JSON writer since 0033.
- graph_model.rs:30 (json_str doc) — cross-referenced RunReport::json_str, deleted this
  cycle. Reworded to describe the escape set directly (graph_model's own json_str stays).
- docs/design/INDEX.md:729 — "golden-tested like RunReport::to_json" framed the hand-rolled
  model JSON by a now-serde to_json. Reframed to name model_to_json as the surviving
  hand-rolled writer.

Cycle 0033 drift-clean after this tidy. Not a milestone close (the param-sweep milestone
fieldtest is a separate deliberate act). Gates: clippy --workspace --all-targets -D
warnings clean (doc-only edits, compile-inert).

refs #54

crates/aura-engine/src/graph_model.rs

@@ -1,8 +1,10 @@
 //! The `aura graph` model serializer (#13, cycle 0026): turns the engine's
 //! authored blueprint (graph-as-data, C9) into the canonical, deterministic JSON
 //! model the browser viewer consumes. Read-only — walks structure + declared
-//! `NodeSchema`s only, never `eval`/`compile`/`bootstrap`. Hand-rolled JSON in the
-//! `RunReport::to_json` house style (no serde, C14).
+//! `NodeSchema`s only, never `eval`/`compile`/`bootstrap`. The model JSON is
+//! hand-rolled (no serde) — small, closed, deterministic (C14). Since cycle 0033
+//! moved `RunReport::to_json` to serde, this is the engine's last hand-rolled
+//! JSON writer.
 
 use crate::{BlueprintNode, Composite};
 use aura_core::{Firing, ScalarKind};
@@ -27,7 +29,7 @@ fn firing_str(f: Firing) -> String {
 }
 
 /// A JSON string literal: wrap in quotes, escape `"` and `\` (the minimal set
-/// `RunReport::json_str` uses — model names are author-controlled identifiers).
+/// sufficient here — model names are author-controlled identifiers).
 fn json_str(s: &str) -> String {
     let mut out = String::with_capacity(s.len() + 2);
     out.push('"');

docs/design/INDEX.md

@@ -726,7 +726,8 @@ signature travels beside the node, so `bootstrap` reads it without a built-node
 #51).** `aura graph` no longer renders ASCII. The render path is now two pieces:
 a read-only **model serializer** (`aura_engine::model_to_json`, iteration 1) that
 walks the root composite + every distinct composite type into a deterministic,
-hand-rolled JSON model (C14, golden-tested like `RunReport::to_json`; the
+hand-rolled JSON model (C14, golden-tested; the engine's last hand-rolled JSON
+writer after `RunReport::to_json` moved to serde in cycle 0033; the
 swapped-param mis-wire property moved here from the old compiled-view test), and a
 **self-contained HTML viewer** (`aura-cli::render::render_html`, iteration 2) that
 inlines that model, the ported prototype viewer JS, and a vendored Graphviz-WASM