refactor(0079): extract the trading-analysis leaf into aura-analysis (refs #136)

aura-engine is documented (C16) and named as the reusable, domain-agnostic
reactive SoA substrate, yet `report.rs` concentrated the trading-domain
analysis layer inside it. This cycle relocates the pure-domain leaf into a new
`aura-analysis` crate (deps: aura-core + serde only), erecting the
engine/domain seam before the Stage-2 broker milestone deposits more
currency/position-event code into the same module. Behaviour-preserving (C1):
the full workspace suite stays green unchanged (665 passed), including the C18
on-disk byte-identity goldens (cli_run, the registry legacy-line loads).

Moved to aura-analysis (bodies verbatim — no float expression re-associated):
RunMetrics, RMetrics (+ its hand-written PartialEq), the private r_col column
indices + SQN_CAP, summarize_r, r_metrics_from_rs, derive_position_events,
PositionAction (+ From/TryFrom<i64>), PositionEvent, and the deflation stats
helpers inv_norm_cdf / expected_max_of_normals. Their unit tests and private
helpers (r_row / r_row_full / pm_row) relocate with them — tests live with
their subject (the r_col helpers reach the private module directly, which a
re-export cannot bridge).

Stays in aura-engine for this cycle: the generic trace plumbing (ColumnarTrace,
join_on_ts, JoinedRow, f64_field), RunManifest, RunReport, and summarize (it
bridges recorded trace columns into RunMetrics, so it is trace-coupled). The
mis-placed orchestration types FamilySelection / SelectionMode also stay
(their relocation is entangled with the registry-vocabulary fork, deferred).

report.rs pub-re-exports the moved symbols, so aura-engine's lib.rs re-export
block and every `crate::report::X` / `aura_engine::X` consumer
(aura-registry, aura-cli, aura-composites, aura-ingest) compile byte-unchanged;
only the new crate, the workspace member list, aura-engine's Cargo.toml dep,
and report.rs itself change.

Deferred to later cycles (genuine design forks, route through specify when
reached): making RunReport generic over a metric type M and re-bounding
sweep/mc/walkforward; relocating the aura-registry Metric / metric_cmp / rank
vocabulary; relocating FamilySelection / SelectionMode. Fork decisions logged
on #136.

Cargo.lock

@@ -46,6 +46,15 @@ dependencies = [
  "derive_arbitrary",
 ]
 
+[[package]]
+name = "aura-analysis"
+version = "0.1.0"
+dependencies = [
+ "aura-core",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "aura-cli"
 version = "0.1.0"
@@ -84,6 +93,7 @@ dependencies = [
 name = "aura-engine"
 version = "0.1.0"
 dependencies = [
+ "aura-analysis",
  "aura-core",
  "aura-std",
  "chrono",

Cargo.toml

@@ -12,6 +12,7 @@ members = [
     "crates/aura-core",
     "crates/aura-std",
     "crates/aura-engine",
+    "crates/aura-analysis",
     "crates/aura-composites",
     "crates/aura-cli",
     "crates/aura-ingest",

crates/aura-analysis/Cargo.toml

@@ -0,0 +1,16 @@
+[package]
+name = "aura-analysis"
+edition.workspace = true
+version.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[dependencies]
+aura-core = { path = "../aura-core" }
+# serde is admitted under the amended C16 per-case dependency policy (INDEX.md):
+# it gives the run-report types a typed (de)serialization path for the run
+# registry (cycle 0029). serde's output is deterministic (C1-safe).
+serde = { workspace = true }
+# serde_json renders RunReport JSON for both the registry (disk) and stdout
+# (RunReport::to_json) — one shape, no hand-rolled writer (amended C16).
+serde_json = { workspace = true }

crates/aura-engine/Cargo.toml

@@ -7,6 +7,11 @@ publish.workspace = true
 
 [dependencies]
 aura-core = { path = "../aura-core" }
+# aura-analysis holds the pure trading-domain reductions (R-metrics, the
+# position-event table, the multiple-comparison hurdle math) lifted out of
+# `report` (issue #136). The engine re-exports them via `report::` so callers
+# resolve the moved types through aura-engine unchanged (C18 byte-identity).
+aura-analysis = { path = "../aura-analysis" }
 # serde is admitted under the amended C16 per-case dependency policy (INDEX.md):
 # it gives the run-report types a typed (de)serialization path for the run
 # registry (cycle 0029). serde's output is deterministic (C1-safe).