fix(aura-runner, aura-cli): milestone-fieldtest bugs — library exposes-neither guard, override class, doc truth

RED-first fixes for the two code bugs the safe-to-embed milestone
fieldtest caught: (1) run_signal_r panicked (exit 101) on a blueprint
exposing neither bias nor a declared tap — the CLI pre-validated but the
library seam, the very surface the milestone promises is kill-free, did
not; the guard now refuses class 2 with the CLI's prose family before
wrap_r (run_measurement has no wrap seam and no hole). (2) The override
unknown-param refusal exited 1 through the one inline site the #297
adjudication missed; it and its wrapped-retired sibling are class 2 now,
three existing pins re-pinned with the adjudication comment.

Doc truth from the same fieldtest: the guide's campaign no-data class
corrected (contained cell faults exit 3, not 1), TapPlanError's rustdoc
no longer advertises the retired exit-1 register, and C30 records that
rev + the embedding's committed lockfile are the reproducible-build
contract (branch-referenced engine deps resolve at lock time).

refs #296

docs/design/contracts/c30-stability-discipline.md

@@ -25,9 +25,13 @@ hand-maintained version.
      refused at load (point 3), never trusted.
    - An **external embedding** (a World program in its own repo)
      consumes the workspace crates as a cargo git dependency pinned to a
-     rev. The pin is the whole contract: updating it is a deliberate act
-     that accepts whatever moved, with the design ledger and commit
-     bodies as the changelog.
+     rev. The pin names the engine; the embedding's own committed
+     `Cargo.lock` freezes the rest of the graph — dependencies the
+     engine itself takes as git-branch references (e.g. the data-server)
+     resolve at lock time, so rev + lockfile together are the
+     reproducible-build contract (fieldtest finding, 2026-07-26).
+     Updating either is a deliberate act that accepts whatever moved,
+     with the design ledger and commit bodies as the changelog.
 
 3. **The load handshake refuses non-identical builds.** The cdylib
    handshake already refuses a rustc mismatch (`RUSTC_VERSION`, emitted