feat(aura-cli): render the graph as a self-contained WASM-Graphviz viewer; retire ascii-dag

Iteration 2 of cycle 0026 (graph render redesign). `aura graph` no longer emits
ASCII: it now prints one self-contained `.html` to stdout — the ported prototype
pin-graph viewer (drill / inline-expand / styled tooltips / breadcrumb) driven by
the deterministic model serializer that shipped in iteration 1, with layout and
SVG done in-browser by Graphviz compiled to WebAssembly. Closes the redesign
opened by spec 0026; unblocked by cycle 0027 (input ports are now named, so the
viewer labels every input pin from the model's real names instead of inventing
"a"/"b").

What ships:
- crates/aura-cli/assets/: the ported graph-viewer.js (prototype genDot/chrome
  verbatim + a normalizeModel adapter mapping aura's real model tuple shape —
  ins = [kind, firing, name], index node keys, `comp` refs, `src_<role>` — into
  the viewer's native shape), plus the vendored Graphviz-WASM (@viz-js/viz@3.7.0)
  and svg-pan-zoom@3.6.1 blobs and a refresh-assets.sh provenance script.
- crates/aura-cli/src/render.rs: render_html(&Composite) -> String, a read-only
  (C9) assembly — model_to_json + include_str! of the inlined assets, no eval,
  no build, no serde (C14). The `["graph"]` arm calls it.
- Retired: the ascii-dag adapter (graph.rs), the `ascii-dag` dependency, the
  `--compiled`/`--macd` graph flag plumbing, render_compiled, the color/terminal
  plumbing, and the 12 ascii-dag-asserting tests + the now-orphaned helpers.
  The cli_run integration test now pins the HTML page envelope.
- crates/aura-core/src/node.rs: the two last ascii-dag prose justifications
  re-grounded (single-line label rule kept, re-justified generically; the
  param-generic rule re-justified on C23, not on a renderer limitation).
- docs/design/INDEX.md: the cycle-0026 C9 realization note (both iterations).

Vendoring decision (spec deferred it to the plan): the WASM/JS blobs are checked
in, not fetched at build time. include_str! needs them at compile time, and a
build-time unpkg fetch would make the build non-hermetic/non-offline and let the
shipped artifact drift with the registry — against C1 (determinism) and C8
(frozen artifacts). ~1.4 MB is the price of a hermetic, frozen render asset.

Three adaptations beyond the plan, each verified: (1) render.rs imports
`aura_engine::Composite` (the path model_to_json takes), not aura_core; (2)
macd_blueprint is now test-only — removing the `--macd` arm left it used solely
by the param-space test, so it took `#[cfg(test)]` rather than removal or an
`#[allow]` suppression (the production `aura run --macd` path is intact, verified
emitting JSON); (3) the `grep ascii-dag` over crates/ matches only the new
contract test, which names the term deliberately to document the retirement — no
stale justification prose remains.

Invariants held (verified independently, not on agent report): C9 (render path
read-only), C10 (viewer is a render asset, no logic/DSL), C4 (four-colour palette
= the four scalar base types), C14 (no serde). The iteration-1 model byte golden
is unchanged and green. cargo build --workspace: 0 errors. cargo test --workspace:
157 passed, 0 failed (incl. the two new HTML tests + the unchanged model_golden).
cargo clippy --workspace --all-targets -- -D warnings: clean. ascii-dag absent
from `cargo tree -p aura-cli`.

closes #51

docs/design/INDEX.md

@@ -693,6 +693,25 @@ from the carried signatures, buffer depth from `lookbacks()`). The per-flat-node
 signature travels beside the node, so `bootstrap` reads it without a built-node
 `schema()` call (which no longer exists, see the C8 0024 realization).
 
+**Realization (cycle 0026 — graph render redesign: model + WASM-Graphviz viewer,
+#51).** `aura graph` no longer renders ASCII. The render path is now two pieces:
+a read-only **model serializer** (`aura_engine::model_to_json`, iteration 1) that
+walks the root composite + every distinct composite type into a deterministic,
+hand-rolled JSON model (C14, golden-tested like `RunReport::to_json`; the
+swapped-param mis-wire property moved here from the old compiled-view test), and a
+**self-contained HTML viewer** (`aura-cli::render::render_html`, iteration 2) that
+inlines that model, the ported prototype viewer JS, and a vendored Graphviz-WASM
+blob into one page emitted to stdout. Layout/SVG happen in the browser via
+WebAssembly — aura ships no layout engine and stays a serializer (C9: graph-as-data,
+no `eval`/build on the path). The viewer is a render asset (C10 — no node/strategy
+logic, no DSL); it labels every input pin from the model's now-real names (C23
+debug symbols, named in cycle 0027) and colours wires by the four scalar base
+types (C4). This **retires `ascii-dag`** and its adapter (`graph.rs`), the
+`--compiled`/`--macd` flag plumbing, and the invented `#Sf`/`:=`/`histogram →`
+notation — superseding the cycle-0017 flat-ascii model and its renderer-defect
+workaround. The DOT/SVG are Graphviz-version-dependent and not golden-tested; the
+deterministic JSON model is the asserted contract.
+
 ### C20 — Strategy ↔ harness; the harness is the root sim graph
 **Guarantee.** A **strategy** is a reusable composite-node blueprint (C9):
 broker-, data-, and viz-independent, with inputs declared as named **roles**