refactor: split aura-analysis into statistics and backtest metrics

C28 phase 5 (Stratification): the backtest reductions - RunMetrics, RMetrics,
summarize_r, r_metrics_from_rs, and the position-event table - move verbatim
into aura-backtest::metrics, beside the position_management producer whose
record layout they read (the r_col/cost_col lockstep contract is now
intra-crate; its stale "aura-std" comment corrected). aura-analysis is reduced
to the domain-free half: the multiple-comparison hurdle math (inv_norm_cdf,
expected_max_of_normals) and the selection-provenance types
(FamilySelection/SelectionMode - kept beside the statistics so
RunManifest.selection embeds a foundation-grade type), [dependencies] = serde
only.

The engine re-export surface is name-unchanged (report.rs re-imports from both
crates), so no indirect consumer needed a source edit; aura-backtest moves from
aura-engine's dev-dependencies into [dependencies] as a commented TRANSIENT
widening of the C28 violation, removed by the phase-2 edge cut on this branch.
The campaign drift guard imports its pinned types from their new source
crates. Behaviour-preserving: 1448/0 tests, clippy -D warnings clean, serde
shapes byte-identical (C18), moved code traceable via git copy detection.

closes #291

crates/aura-engine/Cargo.toml

@@ -7,11 +7,16 @@ publish.workspace = true
 
 [dependencies]
 aura-core = { path = "../aura-core" }
-# aura-analysis holds the pure trading-domain reductions (R-metrics, the
-# position-event table, the multiple-comparison hurdle math) lifted out of
-# `report` (issue #136). The engine re-exports them via `report::` so callers
-# resolve the moved types through aura-engine unchanged (C18 byte-identity).
+# aura-analysis holds the domain-free post-run statistics and the
+# selection-provenance types the engine's `RunManifest.selection` embeds
+# (#136, reduced to the domain-free half by #291). Re-exported via `report::`
+# so callers resolve the types through aura-engine unchanged (C18).
 aura-analysis = { path = "../aura-analysis" }
+# aura-backtest holds the backtest metric reductions re-exported through
+# `report::` (#291). TRANSIENT widening of the known C28 layer violation: the
+# phase-2 edge cut (#147) removes this production edge again on the same
+# branch.
+aura-backtest = { path = "../aura-backtest" }
 # serde is admitted under the amended C16 per-case dependency policy (INDEX.md):
 # it gives the run-report types a typed (de)serialization path for the run
 # registry (cycle 0029). serde's output is deterministic (C1-safe).
@@ -38,7 +43,6 @@ rayon = "1"
 aura-std = { path = "../aura-std" }
 aura-market = { path = "../aura-market" }
 aura-strategy = { path = "../aura-strategy" }
-aura-backtest = { path = "../aura-backtest" }
 aura-vocabulary = { path = "../aura-vocabulary" }
 # chrono / chrono-tz build the Berlin-local-wall-clock epoch-ns timestamps the
 # GER40 session-breakout E2E fixture (tests/ger40_breakout.rs) feeds the engine,

crates/aura-engine/src/report.rs

@@ -11,15 +11,17 @@
 use aura_core::{Scalar, ScalarKind, SeriesFold, Timestamp};
 use std::collections::HashMap;
 
-// The pure trading-domain reductions (R-metrics, the position-event table, the
-// multiple-comparison hurdle math) live in `aura-analysis` (issue #136); they are
-// re-imported here so `report::`'s namespace — and therefore `aura-engine`'s
-// `lib.rs` re-export and every `crate::report::X` reference — resolves unchanged
-// (C18 byte-identity). `summarize` (below) bridges trace columns into these types
-// at the engine boundary, so it stays here.
-pub use aura_analysis::{
-    derive_position_events, expected_max_of_normals, inv_norm_cdf, r_metrics_from_rs, summarize_r,
-    FamilySelection, PositionAction, PositionEvent, RMetrics, RunMetrics, SelectionMode,
+// The backtest reductions (R-metrics, the position-event table) live in
+// `aura-backtest::metrics`, the domain-free hurdle math + selection provenance
+// in `aura-analysis` (issues #136, #291); both are re-imported here so
+// `report::`'s namespace — and therefore `aura-engine`'s `lib.rs` re-export and
+// every `crate::report::X` reference — resolves unchanged (C18 byte-identity).
+// `summarize` (below) bridges trace columns into these types at the engine
+// boundary, so it stays here.
+pub use aura_analysis::{expected_max_of_normals, inv_norm_cdf, FamilySelection, SelectionMode};
+pub use aura_backtest::{
+    derive_position_events, r_metrics_from_rs, summarize_r, PositionAction,
+    PositionEvent, RMetrics, RunMetrics,
 };
 
 /// The reproducible run descriptor (C18). **Caller-supplied**: the engine