refactor(aura-core): split Scalar into a tag-free Cell + ScalarKind

Motivation
----------
`Scalar` was a tagged enum (I64/F64/Bool/Ts), so every scalar value
physically carried its own kind tag. But the kind is already known from
the schema/port/column the value flows through (C7: the type is a
property of the column, not of the value — the hot path is already
columnar `Column<T>`, and `AnyColumn::get` *reconstructs* the tag from
the column on the way out). The per-value tag was therefore redundant
with the kind the surrounding context already holds.

That redundancy had three costs:

  * It baked an implicit `match` (a branch) into every function that read
    a Scalar payload — even where the caller statically knew the type.
    The tag could never be exploited away.
  * Size: a tagged enum is tag + payload = 16 bytes (f64/i64 alignment),
    twice the 8 bytes the value needs. A `Column<Scalar>` would be double
    the memory and half the cache utilisation.
  * It is the shared root of several downstream papercuts we keep hitting
    — the lossy f64 manifest field, the `unreachable!` panic on a
    non-numeric param, the serde-tag question — all symptoms of "the type
    is baked into the value".

Change
------
Introduce `Cell`: a type-erased 64-bit word (`struct Cell(u64)`) that is
not readable without external type context. It is constructed per base
type (`from_i64/from_f64/from_bool/from_ts`) and read only by naming the
type at the call site (`i64()/f64()/bool()/ts()`) — each a branch-free
bit-cast. The hot path resolves the kind once at the boundary (from the
schema) and then reads natively, with no per-value branch. `Cell` knows
nothing of `Scalar` or `ScalarKind`; the dependency is strictly one-way,
and it lives in its own `cell.rs` (more is planned on top of it).

`Scalar` becomes `struct { kind: ScalarKind, cell: Cell }` — the
self-describing form for the dynamic boundaries (builder binding,
serialization, rendering), built on top of `Cell`. Its `as_*` accessors
now `debug_assert` the kind and return the native value (free in
release); calling the wrong accessor is a caller bug, not a checked
`Option`. The variant constructors `Scalar::I64(..)` become associated
fns `Scalar::i64(..)`.

`PartialEq` is hand-written (not derived) to preserve the former enum's
value semantics: kinds must match, then native payloads compare, so f64
keeps IEEE-754 behaviour (`NaN != NaN`, `+0.0 == -0.0`) and a kind
mismatch is never equal even when the raw words coincide. A fixture
(`scalar_eq_is_value_not_bitwise`) pins exactly the cases where bit- and
value-equality diverge, so it can't silently regress. `Cell`'s own
`Eq`/`Hash` stay bitwise — correct for a raw word.

The change is behaviour-preserving: Scalar's observable behaviour is
identical to the pre-Cell enum (the value-equality fixture proves it);
only the internal representation changed. The ~440 call sites across the
workspace are a mechanical constructor rename plus ~12 destructuring
sites (match-arms / `let`-patterns) rewritten to `kind()` + `as_*`.

Verified: cargo build --workspace --all-targets, cargo clippy --workspace
--all-targets -- -D warnings, cargo test --workspace — all green.

crates/aura-engine/src/graph_model.rs

@@ -25,12 +25,12 @@ fn kind_str(k: ScalarKind) -> &'static str {
 /// whole values (`1.0`, not `1`) so a bound f64 is never mistaken for an i64 in
 /// the render. The value side of `kind_str`.
 fn scalar_str(s: aura_core::Scalar) -> String {
-    use aura_core::Scalar;
-    match s {
-        Scalar::I64(n) => n.to_string(),
-        Scalar::F64(f) => format!("{f:?}"),
-        Scalar::Bool(b) => b.to_string(),
-        Scalar::Ts(t) => t.0.to_string(),
+    use aura_core::ScalarKind;
+    match s.kind() {
+        ScalarKind::I64 => s.as_i64().to_string(),
+        ScalarKind::F64 => format!("{:?}", s.as_f64()),
+        ScalarKind::Bool => s.as_bool().to_string(),
+        ScalarKind::Timestamp => s.as_ts().0.to_string(),
     }
 }
 
@@ -426,13 +426,13 @@ mod tests {
     #[test]
     fn prim_record_emits_bound_only_when_bound() {
         // a bound i64 param → a "bound" field carrying [pos,"name","kind","value"]
-        let bound = prim_record(&Sma::builder().bind("length", Scalar::I64(5)));
+        let bound = prim_record(&Sma::builder().bind("length", Scalar::i64(5)));
         assert!(bound.contains(r#""bound":[[0,"length","i64","5"]]"#), "{bound}");
         // the bound slot also leaves the tunable "params" surface (bind's tuning side)
         assert!(bound.contains(r#""params":[]"#), "{bound}");
 
         // a bound f64 value renders canonically (shortest round-trip), e.g. 0.5
-        let f = prim_record(&Exposure::builder().bind("scale", Scalar::F64(0.5)));
+        let f = prim_record(&Exposure::builder().bind("scale", Scalar::f64(0.5)));
         assert!(f.contains(r#""bound":[[0,"scale","f64","0.5"]]"#), "{f}");
 
         // an unbound builder → no "bound" field at all