feat(aura-core, aura-runner): re-arm the ABI handshake — source fingerprint replaces the frozen version stamp

The load seam's aura-core stamp becomes AURA_CORE_FINGERPRINT: an FNV-1a
64 hash over aura-core's sorted src/**/*.rs (prefix-free records: path,
NUL, u64-LE content length, contents), emitted by build.rs beside the
rustc stamp and baked into the descriptor by aura_project!. validate_c_tier
compares fingerprints ('aura-core build'); a stale dylib — same rustc,
different aura-core sources — is refused instead of trusted at the
Rust-ABI tier. RED-first: the headline test pins that the frozen crate
version is never again the host stamp (plus a version-bump-proof twin and
an aura-core shape pin: 16 hex, never CARGO_PKG_VERSION).

Descriptor field renamed aura_core_version -> aura_core_fingerprint
(engine-internal; field names are not ABI, order is). Documented accepted
C30 limit: source-level identity only — the consuming build's lockfile/
features stay outside the stamp. C13/C30 prose aligned.

closes #348

docs/design/contracts/c13-hot-reload-frozen-deploy.md

@@ -22,7 +22,8 @@ A research project compiles to an external cdylib exporting one symbol,
 `AURA_PROJECT`, a two-tier `#[repr(C)]` `ProjectDescriptor`
 (`aura-core::project`, `crates/aura-core/src/project.rs`, emitted by the
 `aura_project!` macro). A **C tier** — `magic` (`AURAPROJ`),
-`descriptor_version`, the rustc-version and aura-core-version stamps, the
+`descriptor_version`, the rustc-version and aura-core build-fingerprint
+stamps ([C30](c30-stability-discipline.md)), the
 namespace, all C-compatible field types — is validated **before** any Rust-ABI
 field is touched; a **Rust tier** — the vocabulary resolver
 `fn(&str) -> Option<PrimitiveBuilder>` and the enumerable type-id list — is read
@@ -37,7 +38,7 @@ via `cargo metadata` (debug default, `--release` opt-in) and loads it
 **load-and-hold** — the `Library` is leaked, never unloaded, so its `'static`
 strings and fn-pointers stay valid (`aura-runner::project::load`,
 `crates/aura-runner/src/project.rs`). `validate_c_tier` checks the four stamps
-front-to-back; a mismatch of either version stamp refuses with exit 1 naming
+front-to-back; a mismatch of either stamp refuses with exit 1 naming
 both sides (`ProjectError::Incompatible`). The project vocabulary is
 charter-checked at load (`check_charter`): non-empty namespace, every id
 `<ns>::`-prefixed, no duplicate, no collision against the std vocabulary,

docs/design/contracts/c30-stability-discipline.md

@@ -37,9 +37,8 @@ hand-maintained version.
    built from. A hand-maintained version that never moves disarms the
    refusal (the pre-C30 state: `CORE_VERSION` frozen at 0.1.0 matched
    every stale dylib); a hand-bumped one re-arms it only between bumps —
-   an implicit ABI promise this contract refuses to make. *(Transition:
-   the shipped handshake still stamps the crate version; re-arming it is
-   tracked as #348.)*
+   an implicit ABI promise this contract refuses to make. *(Re-armed by
+   #348: a source-derived fingerprint replaced the crate-version stamp.)*
 
 4. **The artifact plane is the stable tier.** What was already law,
    stated as the positive promise: registered artifacts are never