audit: trace-handle cycle close — refusal parity, measurement pin, ledger lockstep

Architect review over 9636b00..9221bcd. What holds, confirmed against the
diff rather than the commit body: no stored record shape moved (neither
`aura-engine/src/report.rs` nor the registry compat mirror appears in the
change at all, and the byte pins pass unedited); the handle travels the
beside-the-report route C27/#297 established for the unbound-tap names, with
the library still printing nothing; trace enumeration landed inside
`aura-registry` where C22 puts trace file I/O; no C14 exit class moved, both
refusal arms falling through to the same exit 1.

Two high drift items, both fixed here:

- The corrected refusal claimed a campaign run prints its handle as
  `trace_name` on stdout. It prints `campaign_run.trace_name` — the campaign
  leg wraps its record, as the glossary states outright — so the chain the
  refusal advertised returns null there. This is the third instance of one
  error class in this cycle: a false claim inside the very prose meant to
  stop misdirecting callers. Grounding caught the first two, review the
  third.
- The measurement leg shipped without the handle pin the spec asked for. All
  three new pins drove the strategy path, so the measurement leg emitted a
  handle nothing asserted. It has its own test now, on the shared bind pair
  the two legs cannot drift across.

Ledger and vocabulary brought into lockstep: C27's current state records the
`RunOutcome` carrier that replaced the pair; the glossary's tap entry names
the single-run handle and warns that a family id is not one; the authoring
guide's own single-run tap example now says the name is printed rather than
guessed. The suggestion line gained the `aura:` prefix every other stderr
line carries.

Bench: all five fingerprints OK — the decisive signal, since they hang on the
record bytes this cycle was required not to move. Timing deltas are load
noise (loadavg 8.7 under concurrent agents), not regressions.

refs #309

docs/design/contracts/c27-declared-taps.md

@@ -77,7 +77,12 @@ data-reachable: no flag keeps the record-all default, any flag replaces the
 plan entirely (unlisted taps stay unbound/inert). `BoundTaps` carries the
 unbound tap names out (`skipped: Vec<String>`), riding beside the returned
 report rather than inside it, so the CLI — not the library — prints the
-unbound-tap note (#297). The boundary is thereby
+unbound-tap note (#297). Since #309 both entry points return that pair as a
+named `RunOutcome { report, skipped, trace_name }`, the third field being the
+trace-store handle the run recorded under (`Some` under exactly the condition
+that opens the write path, `None` otherwise) — the same beside-the-report
+discipline, widened rather than re-cut: the record keeps its shape and the
+shell renders the handle. The boundary is thereby
 fixed in place: *selecting* a subscription is run-mode authority, exercised
 by the run-mode owner — on the one-shot path the CLI invocation itself, a
 projection exercising this contract's authority, not a second home for