audit(0079): cycle close — drift-clean; ledger crate-topology sync + serde_json dev-dep tightening (refs #136)

Architect drift review (3e8fd73..HEAD): the extraction is faithful and
behaviour-preserving — every moved symbol's definition left report.rs, 35 unit
tests relocated with their subject, aura-engine/src/lib.rs byte-unchanged, the
four downstream crates byte-unchanged. No code defect. Regression gate green:
cargo build/test --workspace = 665 passed / 0 failed (incl. the C18 cli_run
goldens and the registry legacy-line loads); clippy --workspace --all-targets
-D warnings clean.

Ledger sync (docs/design/INDEX.md) — pre-existing crate-topology drift the
extraction made visible:
- C10 notes (cycles 0063/0068) placed PositionAction / PositionEvent /
  derive_position_events "in aura-engine beside RunMetrics / summarize_r";
  cycle 0079 moved all of them to aura-analysis — corrected, with a forward
  pointer to the new C16 note.
- C10 cycle-0065 note claimed "RiskExecutor ships as a public aura-engine
  composite-builder" and "Composites live in aura-engine ... aura-engine ->
  aura-std a normal dependency"; both stale — composites live in
  aura-composites and aura-std is now an aura-engine [dev-dependencies] only.
  Corrected.
- Added a C16 realization note recording the aura-analysis extraction as an
  architecture fact: the engine<->domain seam, the current five non-node
  workspace crates, and the deferred #136 generic-over-M tail.

serde_json moved from [dependencies] to [dev-dependencies] in aura-analysis
(architect debt item): the production types derive serde, but JSON rendering
lives in aura-engine's RunReport::to_json, so serde_json is test-only here and
must not enter the frozen artifact's library link (C16 frozen-artifact
scrutiny). Build + the 35 crate tests stay green after the move.

No baseline moved (the suite is the regression gate; it stayed green), so no
ratify statement. No spec/plan ephemera to drop (compiler-driven / agent-driven
cycle — no docs/specs or docs/plans files were created).

crates/aura-analysis/Cargo.toml

@@ -11,6 +11,10 @@ aura-core = { path = "../aura-core" }
 # it gives the run-report types a typed (de)serialization path for the run
 # registry (cycle 0029). serde's output is deterministic (C1-safe).
 serde = { workspace = true }
-# serde_json renders RunReport JSON for both the registry (disk) and stdout
-# (RunReport::to_json) — one shape, no hand-rolled writer (amended C16).
+
+[dev-dependencies]
+# serde_json is used only by this crate's round-trip tests (the production types
+# derive serde, but JSON rendering lives in aura-engine's RunReport::to_json).
+# Test-only -> dev-dependencies, so it never enters the frozen artifact's library
+# link (C16 frozen-artifact scrutiny).
 serde_json = { workspace = true }