feat(0074): source real-path pip from the geometry sidecar; drop the authored floor

The data-server now ships per-symbol geometry sidecars, so aura no longer
hard-codes instrument geometry. A consumption grep showed production reads
exactly one `InstrumentSpec` field — `pip_size` — at the real-data path; the
other eight (incl. `instrument_id`) were constructed but never read.

- aura-cli resolves the real-path pip from the recorded sidecar
  (`instrument_geometry` -> `InstrumentGeometry.pip_size`), refusing (exit 2)
  on absent geometry. The authored table no longer gates: any symbol with a
  sidecar + bars now runs (new test: USDJPY, never vetted, resolves its JPY
  pip 0.01 from the sidecar).
- Removed the redundant authored floor: `InstrumentSpec`, `instrument_spec`,
  `VETTED_SYMBOLS`, and the table-only tests. The `InstrumentGeometry` seam
  (the surviving pip source) and its nameability guard are kept.
- `instrument_id` (the "find out"): no production consumer. The position-event
  table's `instrument_id` is a decoupled caller parameter; the engine never
  imports an instrument spec. Dropped with the struct.
- The example `pip_size_of` is re-sourced to the sidecar; the pure-structural
  blueprint tests use a literal pip to stay archive-independent.

Speculative deploy-grade fields and the #124 override/floor tiers are deferred
to the Stage-2 broker that will consume them, read from the sidecar geometry
then. Ledger (C8/C15/#22/#106) updated; #124 collapses to "recorded sidecar
geometry -> refuse" in the meantime.

Verified: cargo test --workspace (all green), clippy -D warnings clean, cargo
doc clean, with the local archive present so the sidecar paths run.

refs #124

crates/aura-engine/src/report.rs

@@ -224,9 +224,9 @@ pub fn summarize_r(record: &[(Timestamp, Vec<Scalar>)], round_trip_cost: f64) ->
 /// executed book (`deal = target - book - in_flight`; `in_flight = 0` for the
 /// instant-fill backtest). Pure (C1); no look-ahead — each event's `event_ts` is
 /// its own cycle (C2). `instrument_id` is supplied by the caller (the engine never
-/// imports `InstrumentSpec`). A reversal emits `Close` then the opposite open at
-/// one `event_ts` (close first); a position still open on the last row emits its
-/// open with no synthetic `Close` (the table records actual executed events —
+/// imports an instrument spec from `aura-ingest`). A reversal emits `Close` then the
+/// opposite open at one `event_ts` (close first); a position still open on the last
+/// row emits its open with no synthetic `Close` (the table records actual executed events —
 /// unlike `summarize_r`, which force-closes for the R metric).
 pub fn derive_position_events(
     record: &[(Timestamp, Vec<Scalar>)],