refactor: split aura-analysis into statistics and backtest metrics

C28 phase 5 (Stratification): the backtest reductions - RunMetrics, RMetrics,
summarize_r, r_metrics_from_rs, and the position-event table - move verbatim
into aura-backtest::metrics, beside the position_management producer whose
record layout they read (the r_col/cost_col lockstep contract is now
intra-crate; its stale "aura-std" comment corrected). aura-analysis is reduced
to the domain-free half: the multiple-comparison hurdle math (inv_norm_cdf,
expected_max_of_normals) and the selection-provenance types
(FamilySelection/SelectionMode - kept beside the statistics so
RunManifest.selection embeds a foundation-grade type), [dependencies] = serde
only.

The engine re-export surface is name-unchanged (report.rs re-imports from both
crates), so no indirect consumer needed a source edit; aura-backtest moves from
aura-engine's dev-dependencies into [dependencies] as a commented TRANSIENT
widening of the C28 violation, removed by the phase-2 edge cut on this branch.
The campaign drift guard imports its pinned types from their new source
crates. Behaviour-preserving: 1448/0 tests, clippy -D warnings clean, serde
shapes byte-identical (C18), moved code traceable via git copy detection.

closes #291

crates/aura-backtest/Cargo.toml

@@ -7,3 +7,13 @@ publish.workspace = true
 
 [dependencies]
 aura-core = { path = "../aura-core" }
+# serde gives the backtest metric types (`RunMetrics`/`RMetrics`/`PositionEvent`)
+# their typed (de)serialization path for the run registry (C18; moved with the
+# types from aura-analysis, #291). Deterministic output (C1-safe).
+serde = { workspace = true }
+
+[dev-dependencies]
+# serde_json is used only by the moved metric round-trip tests (JSON rendering
+# for production lives in aura-engine's RunReport::to_json). Test-only, so it
+# never enters the frozen artifact's library link (C16).
+serde_json = { workspace = true }

crates/aura-backtest/src/lib.rs

@@ -1,10 +1,17 @@
-//! `aura-backtest` — the backtest-execution node layer (C28): simulated execution
-//! without money (the `SimBroker` pip yardstick, position management), measured in
-//! R. Depends only on `aura-core`.
+//! `aura-backtest` — the backtest layer (C28): simulated execution without
+//! money (the `SimBroker` pip yardstick, position management), measured in R,
+//! plus the backtest metric reductions over the recorded streams
+//! (`metrics`, moved from `aura-analysis` by #291). Depends only on
+//! `aura-core` (+ serde for the metric types' C18 wire shapes).
 
+mod metrics;
 mod position_management;
 mod sim_broker;
 
+pub use metrics::{
+    derive_position_events, r_metrics_from_rs, summarize_r, PositionAction,
+    PositionEvent, RMetrics, RunMetrics,
+};
 pub use position_management::{
     ExitReason, FIELD_NAMES as PM_FIELD_NAMES, PositionManagement,
     RECORD_KINDS as PM_RECORD_KINDS, WIDTH as PM_WIDTH,