refactor(aura-registry): split FamilyRunRecord family_id into {family, run} + derived id

Behaviour-preserving normalisation of the lineage record. The fused
`family_id: String` ("{name}-{counter}") is split into its two factors —
`family: String` + `run: usize` — and the user-facing handle becomes a derived
`family_id()` method ("{family}-{run}"), never stored or parsed.

Why: the fused field forced the counter logic to generate-and-check candidate
strings (to stay robust to '-' inside a name) rather than read it; with `run` a
plain int, `next_run` is a clean numeric max+1 over the field. The split is more
normalised (one fact per field) and the only property the fused token bought — a
single paste-able CLI handle — is recovered by deriving it. Storage and all
user-visible output stay byte-identical: append_family still returns
"{name}-{run}", Family.id is still "{name}-{run}", and the CLI prints the same
"family_id" lines (the json! key + the returned String, both unchanged).

Internal-only: FamilyRunRecord and group_families (now keyed on the (family,
run) tuple, first-seen order preserved) change; lib.rs re-exports, the
extractors, and all of aura-cli are untouched (everything downstream goes
through Family.id + append_family's returned String). The on-disk
families.jsonl key changes ({"family","run"} vs {"family_id"}) — a gitignored
runtime artifact with no committed fixture, and tests round-trip within a temp
dir, so no migration is owed. Doc reconciliation: the lineage/lib module headers
and the C18 ledger realization note now describe the split shape.

Verification: a workflow ran the refactor in an implementer agent, then three
adversarial lenses (behaviour-preservation, new-logic correctness,
completeness/doc-lag) tried to refute it — the first two found nothing, the
third flagged the four doc-lag sites now fixed here. Self-run gates:
cargo test --workspace green (registry 11, incl. a strengthened round-trip test
pinning the split fields + derived handle), cargo clippy --workspace
--all-targets -D warnings clean, cargo doc clean.

docs/design/INDEX.md

@@ -664,12 +664,12 @@ the reverse.
 **Realization (cycle 0045 — lineage as related records, #70).** The *lineage*
 depth is now realized as a **family store**: a sweep / Monte-Carlo / walk-forward
 run (the C12 axes) is persisted as a *set of related records* — each a
-`FamilyRunRecord` (a `RunReport` stamped with a shared `family_id` + `kind` +
+`FamilyRunRecord` (a `RunReport` stamped with its `family` + `run` + `kind` +
 `ordinal`) — in a sibling JSONL (`families.jsonl`), leaving the flat `runs.jsonl`
 path and its `append`/`load`/`rank_by`/`optimize` API byte-for-byte unchanged.
-`family_id = "{name}-{counter}"` (an author-supplied name plus a per-name
-generate-and-check run index — not a content hash; re-running the same family
-mints a fresh id). `group_families` is the round-trip that re-derives a family
+the user-facing `family_id = "{family}-{run}"` handle is **derived** from the
+stored `family` name plus a per-name `run` index (assigned as a numeric max+1 —
+not a content hash; re-running the same family mints a fresh id). `group_families` is the round-trip that re-derives a family
 from the stored links (re-listable / rankable as a unit — C21). The manifest *is*
 the re-derivation recipe (#71): no input-stream blob / path / payload enters a
 record, and a member's window is **producer-supplied** via