fix(aura-runner, aura-cli): milestone-fieldtest bugs — library exposes-neither guard, override class, doc truth

RED-first fixes for the two code bugs the safe-to-embed milestone
fieldtest caught: (1) run_signal_r panicked (exit 101) on a blueprint
exposing neither bias nor a declared tap — the CLI pre-validated but the
library seam, the very surface the milestone promises is kill-free, did
not; the guard now refuses class 2 with the CLI's prose family before
wrap_r (run_measurement has no wrap seam and no hole). (2) The override
unknown-param refusal exited 1 through the one inline site the #297
adjudication missed; it and its wrapped-retired sibling are class 2 now,
three existing pins re-pinned with the adjudication comment.

Doc truth from the same fieldtest: the guide's campaign no-data class
corrected (contained cell faults exit 3, not 1), TapPlanError's rustdoc
no longer advertises the retired exit-1 register, and C30 records that
rev + the embedding's committed lockfile are the reproducible-build
contract (branch-referenced engine deps resolve at lock time).

refs #296

docs/authoring-guide.md

@@ -855,9 +855,11 @@ mismatch, a compile error, a tap-bind content fault (unknown fold/tap,
 duplicate) — are the content of the argv-named file and exit 2 like a usage
 error; only its environment refusals (a tap-trace store write failure)
 exit 1. The no-data family (no local data, no data in the requested window,
-no recorded geometry) belongs to the real-data paths — `reproduce` and the
-campaign legs — where it likewise exits 1 (#297; the full partition lives
-in [C14](design/contracts/c14-headless-two-faces.md)). `aura
+no recorded geometry) belongs to the real-data paths: on `reproduce` it
+exits 1, while inside a campaign the same fault is contained per cell
+(#272) — the run completes and exits 3, naming the failed cells (#297;
+the full partition lives in
+[C14](design/contracts/c14-headless-two-faces.md)). `aura
 reproduce`'s identity/pip guard (a stored member's recorded instrument or
 broker/pip label contradicting the source it re-derives against) is
 likewise class 1 on the plain verb — its source is derived from the

docs/design/contracts/c30-stability-discipline.md

@@ -25,9 +25,13 @@ hand-maintained version.
      refused at load (point 3), never trusted.
    - An **external embedding** (a World program in its own repo)
      consumes the workspace crates as a cargo git dependency pinned to a
-     rev. The pin is the whole contract: updating it is a deliberate act
-     that accepts whatever moved, with the design ledger and commit
-     bodies as the changelog.
+     rev. The pin names the engine; the embedding's own committed
+     `Cargo.lock` freezes the rest of the graph — dependencies the
+     engine itself takes as git-branch references (e.g. the data-server)
+     resolve at lock time, so rev + lockfile together are the
+     reproducible-build contract (fieldtest finding, 2026-07-26).
+     Updating either is a deliberate act that accepts whatever moved,
+     with the design ledger and commit bodies as the changelog.
 
 3. **The load handshake refuses non-identical builds.** The cdylib
    handshake already refuses a rustc mismatch (`RUSTC_VERSION`, emitted