fix(aura-cli): sweep --list-axes joins the gated intake class

Fieldtest finding B1: the one remaining authored-envelope FILE route,
sweep --list-axes, skipped the root-name gate — a hand-edited
"name":"../escape" listed mangled, non-bindable wrapped axis names
at exit 0 while every sibling intake refused. The discovery surface now
gates before any axis line prints (exit 1, shared prose), restoring
both the #331 every-authored-intake claim and #328's discovery-surface
identity. RED-first: the e2e refusal test was written and observed
failing (exit 0, axis lines printed) before the fix.

Re-enumeration of every read_to_string-fed envelope load confirms the
class is now closed; C24 additionally ratifies the fieldtest's SG1 —
the refusal core sentence is byte-uniform across sites while the
leading context prefix varies by site convention.

refs #331, #328

crates/aura-cli/src/graph_construct.rs

@@ -913,6 +913,12 @@ pub(crate) fn composite_from_any(text: &str, env: &aura_runner::project::Env) ->
 ///   reason, on the routes that bypass `validate_and_register_axes`
 ///   entirely (#331 cycle-close — these used to plant an ungated envelope
 ///   in the store; see each fn's own comment).
+/// - `list_blueprint_axes` (`aura sweep <FILE> --list-axes`, main.rs): no
+///   registry write and no trace directory here, but a shape-violating root
+///   name otherwise mangles through `wrapped_to_raw_axis` into a printed,
+///   non-bindable axis name instead of refusing (#331 fieldtest finding
+///   c331_2e) — the class rule is every CLI intake reading an authored
+///   envelope from a file gates the root name, not only the writing ones.
 ///
 /// All of these share the identical `name_gate` + `name_gate_fault_prose`
 /// primitives this wrapper uses, so the refusal wording is byte-identical