audit: cycle 0029 (#33) — run registry; one ledger drift fixed

Cycle-close architect review of 16e31fe..HEAD against docs/design/INDEX.md +
CLAUDE.md. Regression gate: none configured (commands.regression: []), so the
architect is the sole gate.

What holds:
- C18 honoured — aura-registry stores (manifest, metrics) RunReports append-only
  to runs/runs.jsonl, reproducible-from-manifest; no git/Gitea duplication, no
  multi-project manager. The depth deferrals (lineage, re-derive, run-diff,
  run_id, Aura.toml runs-dir) are named in the spec, not silently dropped.
- C1 preserved — the sweep stays disjoint/lock-free; "sweep == N independent
  runs" now compares full RunReports; serde_json output is deterministic.
- C12/C19/C20 fit — SweepPoint.report closes cycle C's deferred manifest-per-
  point gap; the manifest stays World-supplied (engine `sweep` is `Fn -> RunReport`,
  domain-free).
- Workspace green (cli_run 11, registry 5, engine 93, …); clippy clean.

Resolution:
- FIX (this commit): docs/design/INDEX.md "External components" (the data-server
  row) still asserted the struck "external-dependency firewall / engine crates
  stay external-dependency-free" framing — stale after the C16 amendment (aura-
  core/aura-engine now link serde). Rewritten to the amended per-case policy.
  The iter-1 commit's "no ledger text still asserts it" missed this mirror; it is
  now true (re-grep clean across the ledger and live source).
- FOLLOW-UP (#54, idea): RunReport has two divergent JSON encoders — serde for
  the on-disk store, hand-rolled to_json for stdout. This was a deliberate,
  spec-named deferral (keep stdout goldens stable this cycle); filed for the
  stdout→serde unification that retires the last hand-rolled writer.

Ratify: the C16 amendment (blanket zero-dependency -> considered per-case policy)
is the intentional contract change of this cycle, justified in the 0029 spec and
the iter-1 commit; this audit ratifies it as drift-clean (the codebase no longer
contradicts it anywhere).

closes #33

docs/design/INDEX.md

@@ -66,13 +66,15 @@ source of truth — not session memory.
   boundary (C3) therefore **transposes** these AoS records into aura's SoA
   columns (C7) and normalizes `time_ms` → canonical epoch-ns at that one
   boundary. Pulled in as a cargo git dependency by the **`aura-ingest`** crate
-  (cycle 0011) — the ingestion edge and the workspace's **external-dependency
-  firewall**: `aura-ingest` is the *only* crate that links `data-server` (hence
-  its transitive `chrono`/`regex`/`zip`), so the engine crates (`aura-core` /
-  `aura-std` / `aura-engine` / `aura-cli`) and the frozen deploy artifact (C13)
-  stay external-dependency-free. Consequence: `cargo build/test --workspace` now
-  resolves from a populated cargo cache (one Gitea fetch) rather than fully
-  offline.
+  (cycle 0011) — the **data-source ingestion edge**, where the `data-server`
+  external tree (and its transitive `chrono`/`regex`/`zip`) enters the workspace.
+  Under the amended C16 **per-case dependency policy** (cycle 0029), `aura-ingest`
+  is no longer a zero-dep *firewall* for the rest: the engine crates link
+  standard vetted crates where they earn their place (e.g. `serde`/`serde_json`
+  for the run registry, cycle 0029), with particular scrutiny for the frozen
+  deploy artifact (C13). Consequence: `cargo build/test --workspace` resolves
+  from a populated cargo cache (a Gitea fetch for `data-server` + crates.io for
+  the standard crates) rather than fully offline.
 - **RustAst (`myc`)** — `~/dev/RustAst`, Gitea `Brummel/RustAst`
   (`http://192.168.178.103:3000/Brummel/RustAst.git`). The predecessor DSL attempt
   (Foundation): **a conceptual reference, never a dependency** — its DSL authoring